{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:be1b64f6-f892-5c65-a159-74092a198825",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3",
      "version": "6.2.19-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@6.2.19",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bc31b87c-b143-58a4-9089-700d53c849df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-beans. Spring Framework 6.2.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e59257d9-a915-5c96-bec0-86bea8d48ac2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.2.19 is not affected by CVE-2022-22970. The vulnerability allowed DoS attacks via data binding of MultipartFile/Part objects to model fields. The fix (commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller, May 2022) filters out AutoCloseable types during bean introspection, preventing file upload objects from being exposed as bindable properties. This upstream fi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b56e8289-9d1a-5f1a-be85-2c3b966e2584",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-41249 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-beans. Target Spring Framework 6.2.19 is not affected by CVE-2025-41249. The vulnerability concerned incorrect annotation detection in type hierarchies with unbounded generics, which could cause security annotations to be bypassed. However, the fix (using ResolvableType.toClass() instead of resolve() and scanning declared methods) was already present in the upstream Spring Framework 6.2.19 release that TuxCare onboarded in July 2026. The fix commits (6d710d482a and 0e3e34bee0) were authored by upstream maintainer Sam Brannen in August-September 2025 and shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b285a010-afe3-50bf-a509-7507e364fda6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@6.2.19-tuxcare.3"
    }
  ]
}