{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4b642768-7136-5eba-9d44-db3cd09992dc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@5.3.33-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.33-tuxcare.3",
      "version": "5.3.33-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@5.3.33",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:16daef48-ae4c-55ef-b1a7-f8b588844a5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-context. not_affected \u2014 The target repository (Spring Framework 5.3.33) is NOT affected by CVE-2022-22968. The vulnerability, which allowed bypassing disallowedFields restrictions through case variation (e.g., \"userId\" vs \"UserId\"), was fixed in upstream version 5.3.19. Version 5.3.33 already contains the upstream fix that makes disallowed field pattern matching case-insensitive, preventing such bypass attacks. The fi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:03d7cc0a-87a4-5b77-b576-88936da64a19",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:43f7ea4d-50f2-5280-9353-e7e07b928b18",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.33-tuxcare.3 of org.springframework:spring-context, and is fixed in 5.3.33-tuxcare.5."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@5.3.33-tuxcare.3"
    }
  ]
}