{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:35e17c65-594a-53bc-88a0-e5afb4ea9d7f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-thymeleaf", "version": "2.3.6.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:57aa37e5-e43c-5429-a148-de785c735502", "id": "CVE-2022-22965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf. CVE-2022-22965 (Spring4Shell) is a data-binding RCE whose vulnerable code resides entirely in Spring Framework's spring-beans module (CachedIntrospectionResults). Spring Boot ships no vulnerable code for this CVE \u2014 it only dependency-manages the Spring Framework version via its BOM." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4b4aaaa5-f878-5e3b-bdd6-8d0aaa79ae70", "id": "CVE-2023-20873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6ee2afc4-38b4-5b15-a927-c3e975efc58e", "id": "CVE-2023-20883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c52f5dc1-3b47-5fc1-9659-3dbf818f68f4", "id": "CVE-2023-34055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:48fc89e1-03bd-50a2-8eee-af9fa9bb3d26", "id": "CVE-2023-38286", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-38286 is a false positive for org.springframework.boot:spring-boot-starter-thymeleaf 2.3.6.RELEASE-tuxcare.5." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:798b77ca-76a2-5fe4-81fc-aa9603d87a59", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f7fea47e-8c64-5bba-998e-5944b7307ccd", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f6c26870-34ac-5acb-b590-11366b5c66de", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c1e6b320-43d1-500d-939a-d0781b487b78", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0919a363-d51f-5301-83a5-d5d10cc0ba4a", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:18924e9c-fd4f-53dd-8b85-c5886013c53e", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e75685da-8095-5c95-88d7-6d1f3a47a69a", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5efa3f56-75fa-5723-bb97-0e16e499f642", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:744d1d32-d830-5f3a-a061-055970b07c3f", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf. not_affected \u2014 Spring Boot 2.3.6.RELEASE-tuxcare.4 is not affected by CVE-2026-40992. The vulnerability affects the MailProperties.Ssl auto-configuration feature introduced in Spring Boot 3.4+, which does not exist in version 2.3.6. The target version uses a simpler architecture where mail auto-configuration only passes through user-configured JavaMail properties without actively managing SSL configuration." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8b9b61d8-1e9e-590a-b0bf-f4bf5445491c", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-starter-thymeleaf." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.3.6.RELEASE-tuxcare.5" } ] }