{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6d317b29-db79-54ed-bf90-447c1578108f",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-r2dbc",
      "version": "5.3.31-tuxcare.10",
      "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:ef3a47b1-b9c1-579e-9911-f91b1fa250b4",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca0b6a8c-a7fb-50e4-9ed8-08a43f4dcbdb",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3cf2094f-725e-5495-8027-22f22774342e",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6e32442c-2149-5267-a734-997bb3c33316",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:50dc926c-dae7-5f0e-a788-404e9385f7cb",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:172633b3-6984-5cc6-bc80-62b5296b2384",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7ee5e20-3146-5d0c-97fd-41e59fa5b716",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:954e7fa7-09cf-5a8b-b3cf-37cee33f6a9b",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0c5408c1-ef3c-50bc-b4d9-84be3b0d3913",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:79ba0aaf-d080-5fdb-8e56-4ff3068ff54f",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e16bee3c-238f-590f-acfd-0427bda23a8c",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3fb9f2c4-e34c-5a4c-a1cf-457406a72754",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-r2dbc 5.3.31-tuxcare.10."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bcc61573-3dfa-58e0-b6bd-2765dfd70fce",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d4bbaa62-8f85-5e2d-a56f-d25a9e805410",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:458f57af-9c9b-52f4-a2a0-5236deb74c01",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:695ac697-a727-5e55-b72d-34b59101e12c",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db0258d2-6029-5024-aa3b-50b8dd2442d9",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c6ebea9e-f849-5432-9345-217c6c6e8602",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:af009267-6b68-5cb4-a972-a7e1699df833",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2df53383-b1c4-5699-8f0f-36a891d49a43",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7cafdd6-f75a-5695-b0f1-29a369ef8f3d",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f67aa007-02d9-5615-bb1e-cc76c99db92e",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:389834a4-408d-5ab4-8fcc-563247080f3a",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d204f014-9056-5cb8-bbae-1de8d3c1d2e8",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:02e9a73f-ba30-5bfc-a176-5f287f3e8961",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:93d66a18-4b9e-5eeb-b0dc-2173ed9bb662",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d89e7848-df97-5180-b8bf-89137b6437ee",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:90246843-8084-5ccb-8106-99a3be5b1b47",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dcb4d8f6-4c79-5707-ad04-6cca4a7a70d3",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ae77fd5-1e21-5952-9a74-2b04aee85152",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a4ad70d4-43e5-563b-8398-d0e0bd607980",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2be90be-efab-5ac1-bb5d-5413f627cbd4",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ea547273-6b34-5206-855a-b5f21760e619",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0f5cb840-b586-5d59-8745-c7e8cf4bf37b",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ef0cdc0e-cb5c-5c9c-aad0-7e258ee9e141",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3a203078-7f65-5313-8216-a82c5bcc5503",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ae7a8b78-d1a3-5757-b4e4-83c8b5fbd46d",
      "id": "CVE-2026-41854",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3d9e2aa6-43c2-59bf-b9d7-be96630e7065",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.10"
    }
  ]
}