{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:61c9b415-db70-5cdc-9373-960b0ddd3ac7",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9",
      "type": "library",
      "group": "org.springframework.boot",
      "name": "spring-boot-starter-log4j2",
      "version": "2.4.6-tuxcare.9",
      "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:4aac257f-510c-58f8-b08a-287071096043",
      "id": "CVE-2022-22965",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b9abfeb3-be9f-546f-bc9d-4a6f94966a2e",
      "id": "CVE-2023-20873",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:02314b25-6eb8-52fb-af22-7ddd3322512e",
      "id": "CVE-2023-20883",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b9827eb3-a6c3-5a77-976f-ba9e7c862c81",
      "id": "CVE-2023-34055",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6d25444d-5ece-51c0-b6a7-60735ec869a4",
      "id": "CVE-2023-38286",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-38286 affects version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:34736b8f-dedd-5489-a030-5e16b87424e7",
      "id": "CVE-2024-38807",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dc92340b-3758-5009-bcf7-4faf7ea061b2",
      "id": "CVE-2025-22235",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1cbdaaf1-cb6b-57f1-b450-bfa068847d1f",
      "id": "CVE-2026-22733",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:63bd442f-83c3-57b4-936d-15b613fba8be",
      "id": "CVE-2026-40972",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:617ec792-bb3e-50c1-b7c2-678438fc629a",
      "id": "CVE-2026-40973",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4606bfed-37ad-51a5-802e-5a8e6c323f3f",
      "id": "CVE-2026-40974",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ef79e7c-add1-5312-9a5e-b9fff27f9e00",
      "id": "CVE-2026-40975",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a23f95b8-2ecb-5a67-ba6b-a0d3cb1a1f59",
      "id": "CVE-2026-40977",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:31d47624-d2b7-5f94-988f-afc8a5ff8e81",
      "id": "CVE-2026-40992",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40992 affects version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9ef22878-b8b3-5b10-b86f-3adeb3fc1c07",
      "id": "CVE-2026-41001",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41001 affects version 2.4.6-tuxcare.9 of org.springframework.boot:spring-boot-starter-log4j2."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-log4j2@2.4.6-tuxcare.9"
    }
  ]
}