{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:29ab0bad-52d0-59eb-8608-fe11253574bb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-mail", "version": "2.3.6.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c438a381-7315-5e0d-8ee2-4ee3af947fdb", "id": "CVE-2022-22965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail. CVE-2022-22965 (Spring4Shell) is a data-binding RCE whose vulnerable code resides entirely in Spring Framework's spring-beans module (CachedIntrospectionResults). Spring Boot ships no vulnerable code for this CVE \u2014 it only dependency-manages the Spring Framework version via its BOM." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c36abfa8-ce5c-5325-ae46-ae4d2e037779", "id": "CVE-2023-20873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b4534a8-b5ac-5c75-98b7-a77b12b3d3bc", "id": "CVE-2023-20883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f717720c-f941-5b77-90ea-03d6e721533d", "id": "CVE-2023-34055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2c52acc7-0afe-5011-9d8a-3f6d7de433f0", "id": "CVE-2023-38286", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-38286 is a false positive for org.springframework.boot:spring-boot-starter-mail 2.3.6.RELEASE-tuxcare.5." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6707de8b-923b-5433-bdbf-201916386e40", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f26e8ea7-2c1f-5434-89c1-546a662042ed", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0281cc03-b411-587c-a517-ff6ecb36012d", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:384e1c42-60ce-5117-9e56-9358a377709b", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:83f9363d-b999-5b98-ae1e-9b47b7d7f2a3", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:497d1e09-92c6-575f-9d78-824393a79002", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:90b853da-79dd-5a2c-bc23-0d893eddb99b", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d5fc39ad-10ad-54e1-8044-afb63948cdfe", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:15e5ffd9-33a8-5809-873a-1f340d397a6d", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail. not_affected \u2014 Spring Boot 2.3.6.RELEASE-tuxcare.4 is not affected by CVE-2026-40992. The vulnerability affects the MailProperties.Ssl auto-configuration feature introduced in Spring Boot 3.4+, which does not exist in version 2.3.6. The target version uses a simpler architecture where mail auto-configuration only passes through user-configured JavaMail properties without actively managing SSL configuration." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0f196fc4-c10f-586e-b61f-9a6ab11fc00a", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-mail." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.3.6.RELEASE-tuxcare.5" } ] }