{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:77bec4f2-fc1b-59db-a401-87014debc1fd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8",
      "version": "6.2.15-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@6.2.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8fea78d4-3df5-5db8-8745-62efdbda69f1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-beans. Spring Framework 6.2.15 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1c52e6a9-4820-5b19-9b17-426c6d0e6c5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.2.15 is not affected by CVE-2022-22970. The upstream vendor fix (commit 83186b689f by Juergen Hoeller) was already present in the upstream release when TuxCare onboarded version 6.2.15. The fix prevents DoS attacks through unclosed AutoCloseable resources during data binding by filtering AutoCloseable types (and URL.content specifically) from introspectable read-only properti...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:aca1b65f-8343-5e68-9bf8-bc7f6e02cb12",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-41249 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-beans. CVE-2025-41249 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability was already fixed in the upstream Spring Framework 6.2.15 release before TuxCare onboarded it. Both upstream fix commits (6d710d482a and 0e3e34bee0) are ancestors of the TuxCare onboarding commit (530f923fc0), confirming the fixes shipped with the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:114a2e6d-5530-5436-98ea-63c3182f4c7c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@6.2.15-tuxcare.8"
    }
  ]
}