{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6ebe9fa3-8df6-5738-ba2a-b7047e964c7e",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "name": "spring-security-acl",
      "version": "6.2.7-tuxcare.2",
      "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:f06c9103-5365-553b-a416-7dcd3fe7ec81",
      "id": "CVE-2024-38827",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fa548b31-ca4e-5e09-abdc-29fae3a017d0",
      "id": "CVE-2025-22228",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65b01700-f828-514d-8a76-acb3df3de5c9",
      "id": "CVE-2025-22234",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ceb6e233-a6b5-586a-a1f8-97a52bb9ccb1",
      "id": "CVE-2026-22732",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:988c3e05-4abc-554d-afab-14cf946276fa",
      "id": "CVE-2026-22746",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ed858a3e-8de7-5391-8690-d7b41c51a8bc",
      "id": "CVE-2026-22747",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22747 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e7bfc8b0-45ff-5028-9062-9cc9d53498a9",
      "id": "CVE-2026-22748",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22748 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2d19506-e2d8-5d30-a377-c76b6a17d79e",
      "id": "CVE-2026-22753",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22753. The vulnerability concerns PathPatternRequestMatcher.Builder bean handling, a feature introduced in version 7.0.0. Version 6.2.7 uses a completely different request matching architecture based on MvcRequestMatcher and AntPathRequestMatcher, with servlet path handling implemented via MvcRequestMatcher.setServletPath(). The vulnerable code ..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b3c17080-6ebb-54b5-a2e8-1255e209d1c2",
      "id": "CVE-2026-22754",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean (introduced in 7.x) where basePath assignment was missing. Version 6.2.7 uses a different architecture (MvcRequestMatcher for servlet-path handling) that does not have this vulnerability pattern."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4903ca4b-f7bd-5226-9c7f-4f395fdce6b3",
      "id": "CVE-2026-40988",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40988 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:240a1a73-b740-50a1-b0b9-cb11e19228ff",
      "id": "CVE-2026-40993",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40993 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ae92598c-4a88-50c5-9b8c-53afd1389f08",
      "id": "CVE-2026-41003",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41003 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:210c7ae4-53b4-55f5-9431-4c9aab73ce89",
      "id": "CVE-2026-41694",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41694 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e59dfa72-e087-5b25-8dfa-902f023bdba5",
      "id": "CVE-2026-41706",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41706 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6d7fff1e-b7fb-5b92-a329-22a90076786c",
      "id": "CVE-2026-47838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-acl."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.7-tuxcare.2"
    }
  ]
}