{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:95005f28-13be-578d-8e7d-52c33806b25f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1",
      "version": "6.2.14-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@6.2.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7ec13a14-8949-58aa-95e1-04d58c303209",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-beans. Spring Framework 6.2.14 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6ad65f12-083c-5f2e-bac0-d72e4eaa5a7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-beans. not_affected \u2014 CVE-2022-22970 fix was already present in upstream Spring Framework 6.2.14 release. The vulnerability (DoS through expensive getter invocation on AutoCloseable/ClassLoader/ProtectionDomain properties during bean introspection) is not present. The target contains the upstream fix at CachedIntrospectionResults.java:263-267,362-367, which skips introspection of read-only dangerous properties, bloc...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:84da842a-2587-5795-9825-2702aaf8fe9d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-41249 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-beans. The target Spring Framework 6.2.14-tuxcare.2 is NOT affected by CVE-2025-41249. The vulnerability concerns incorrect annotation detection in type hierarchies with unresolved generics, which could lead to authorization bypass when using Spring Security's @EnableMethodSecurity. However, the upstream vendor (Spring) fixed this issue in commits 6d710d482a and 0e3e34bee0, and both fixes were already present in the upstream release 6.2.14 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ef92244b-6a27-52c1-bd77-e157be0e3bb5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@6.2.14-tuxcare.1"
    }
  ]
}