{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:77c2f291-fa77-5fdd-b4ff-7e9bbd94265f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4",
      "version": "6.2.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@6.2.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f4cd5582-0af3-50c4-8784-b04a1dae16a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-beans. Spring Framework 6.2.13 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0aafbd4f-7146-53f1-a8e1-242c006fd6c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-beans. not_affected \u2014 The target (Spring Framework 6.2.13-tuxcare.4) is not affected by CVE-2022-22970. The vulnerability was fixed in upstream commits 83186b689f (2022-05-11) and ec3f59e6fe (2022-11-14) by Juergen Hoeller from VMware, both included in upstream release 6.2.13 before TuxCare onboarded it. The fix blocks property introspection of AutoCloseable types (like InputStream from MultipartFile.getInputStream(...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3174bcbe-5193-5693-b36f-3e071c35e84c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-41249 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-beans. CVE-2025-41249 affects Spring Framework's annotation detection mechanism when processing methods in type hierarchies with parameterized super types containing unbounded generics. The vulnerability occurs when ResolvableType.resolve() returns null for unresolved generics, preventing annotation scanners from recognizing method overrides and thus bypassing security annotations like @PreAuthorize. The upstream fix (commit 6d710d482a by Sam Brannen, Aug 2025) changed .resolve() to .toClass() in AnnotatedMethod.isOverrideFor() and AnnotationsScanner.hasSameGenericTypeParameters(), ensuring unresolved generics map to Object.class instead of null. This fix shipped in upstream Spring Framework 6.2.13, which TuxCare onboarded in commit 730f4d1861. The target repository at version 6.2.13 (SHA 0b8d1fbf21) contains this upstream fix and has never been vulnerable to CVE-2025-41249.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:709f04eb-de85-5b00-8fd4-2f239a8d4595",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@6.2.13-tuxcare.4"
    }
  ]
}