{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b4a5ba4a-bd0b-5a39-b004-8b735cf4d2ca",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "thymeleaf-spring5",
      "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.thymeleaf",
      "bom-ref": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2",
      "version": "3.0.15.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "thymeleaf-spring5",
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE",
            "type": "library",
            "group": "org.thymeleaf",
            "version": "3.0.15.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-43466",
      "affects": [
        {
          "ref": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5ce50cb9-6b91-52e2-98de-5a1fb583654c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43466 does not affect version 3.0.15.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5. CVE-2021-43466 is NOT present in thymeleaf-spring 3.0.15.RELEASE. The vulnerability affects version 3.0.12 and was comprehensively fixed in versions 3.0.13 and 3.0.14 by upstream maintainer Daniel Fern\u00e1ndez. The target version 3.0.15.RELEASE includes all security fixes that were already present in the upstream release when TuxCare onboarded it. The vulnerable Server-Side Template Injection pattern no longer exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13.RELEASE), NVD (= 3.0.12), Snyk (< 3.0.13.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-40477",
      "affects": [
        {
          "ref": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a2d7399c-8fca-5e8d-97af-6aecf46b3c25",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40477 affects version 3.0.15.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5."
      }
    },
    {
      "id": "CVE-2026-40478",
      "affects": [
        {
          "ref": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:62705c93-b898-5a9f-adf6-87a9667e86d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40478 affects version 3.0.15.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5."
      }
    },
    {
      "id": "CVE-2026-41901",
      "affects": [
        {
          "ref": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d9ee094f-1c7b-5d6e-957d-78a5ea656834",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41901 affects version 3.0.15.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.0.15.RELEASE-tuxcare.2"
    }
  ]
}