{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2077ae1a-9e0d-5693-b14f-7478a6bd870a",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "name": "spring-security-rsocket",
      "version": "6.2.7-tuxcare.1",
      "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:03a09093-016f-5c6d-818f-a22a6604ccf1",
      "id": "CVE-2024-38827",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:81d8a1ad-c1af-5cd3-a578-b175515d42d1",
      "id": "CVE-2025-22228",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:91ed326a-8a05-51e0-8eb8-1753c2e804f5",
      "id": "CVE-2025-22234",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c5a0c021-4fcd-5e00-894a-540fce89ccab",
      "id": "CVE-2026-22732",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22732 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:627af54e-b04b-5596-aedc-b56858c96284",
      "id": "CVE-2026-22746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22746 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ecaf0e38-bef7-5d52-a4c3-3d1abf4ee6c2",
      "id": "CVE-2026-22747",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22747 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49bd8511-9b79-58a4-8a7b-792afd79520e",
      "id": "CVE-2026-22748",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22748 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:99514ece-5c1c-5ca7-bc68-ed9b993e9c15",
      "id": "CVE-2026-22753",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22753. The vulnerability concerns PathPatternRequestMatcher.Builder bean handling, a feature introduced in version 7.0.0. Version 6.2.7 uses a completely different request matching architecture based on MvcRequestMatcher and AntPathRequestMatcher, with servlet path handling implemented via MvcRequestMatcher.setServletPath(). The vulnerable code ..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7e2eff2-2ed8-591a-bef8-5ad3a42140c3",
      "id": "CVE-2026-22754",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean (introduced in 7.x) where basePath assignment was missing. Version 6.2.7 uses a different architecture (MvcRequestMatcher for servlet-path handling) that does not have this vulnerability pattern."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:533a1766-7e80-59fb-a45f-40e72093f7d9",
      "id": "CVE-2026-40988",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40988 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5894a510-e5a7-53fe-b877-9f9b5147952c",
      "id": "CVE-2026-40993",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40993 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eb21537e-e02f-5012-bed4-0e182540a083",
      "id": "CVE-2026-41003",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41003 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da6c4219-a0a2-59d7-8cc2-52d937e0e20c",
      "id": "CVE-2026-41694",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41694 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a6c281b5-bd11-5002-93d6-9e7be18dc048",
      "id": "CVE-2026-41706",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41706 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc20a427-6ea6-5e7f-9b20-6f679d21567a",
      "id": "CVE-2026-47838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.7-tuxcare.1"
    }
  ]
}