{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ac685533-4699-556a-bf7b-a9aed2cb146c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.13-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.13-tuxcare.4",
      "version": "6.1.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c9558e5b-3825-5c1a-a83f-26e055ecd36d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.13-tuxcare.4 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is not present in Spring Framework 6.1.13. The vulnerability, which allowed bypassing disallowedFields protection via case variation, was fixed in upstream Spring Framework by commit a7cf19cec5 (April 3, 2022). This fix was already included in the Spring Framework 6.1.13 release that TuxCare onboarded on August 21, 2026. The fix makes disallowedFields pattern matching case-insens...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:68e60519-e189-5b13-8aab-e0cd3947768c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38820 affects version 6.1.13-tuxcare.4 of org.springframework:spring-context, and is fixed in 6.1.13-tuxcare.5."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f6a3275a-a310-5ebe-86d1-078f58df7714",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.1.13-tuxcare.4 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.13-tuxcare.4"
    }
  ]
}