{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:56dd4952-3e86-5c98-a75f-9ec2dcce6cf8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8e5af06f-ed0b-5773-bebe-9f7397016634", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6cd3b89-f361-5c91-b567-4181c75acf3d", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cca84998-ce1f-52b7-8eba-b089fd1498da", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3db65e5d-23f7-5393-8ae1-ddf922ff0cb2", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a3dc6b34-a78a-5778-8562-28f3b049de52", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fc494368-b885-532c-959f-4f3bb6153c59", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cf21f3fc-f0e3-591b-b471-b737638da80d", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c53c54cd-4ce8-5c95-a298-199f0f24ac09", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fed515b2-5225-5ef5-b562-3e6feb8dab36", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cfc8fa49-4009-5ea2-a547-d9ec561d3cd9", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3ce1a3e7-52b7-561f-aa65-a109f695571f", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fc4c03c0-0ae3-52b2-9203-59bccca37c56", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:55bc0ef2-8bd7-5127-a10d-c0fbac876630", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:79539015-e5ea-5de2-aae9-63edb0b0c085", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2a529e99-fc83-5b29-a4df-fa4c6d658356", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3ebd20bd-9d98-5e01-89b3-19febd0752ba", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-aop 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8ec2b53-4db4-5212-84be-18862e5caeba", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:619412cb-c923-5792-920b-2a958f60bd0e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2efe6a84-8b0a-516a-a3ba-b9be404a8eb4", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f81f77e-913b-5831-9bd7-b05a8cb92848", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a37ce967-75fc-5a9b-8f67-b38187580486", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f8f085bb-88a0-585d-99e1-2d73ef4b8964", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:870c043c-6ddd-5c33-9903-4246b4bb2385", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1818c72e-5ed8-5813-9d68-7cefe231533c", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29383516-596a-5562-bc24-fcaf21037839", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d7ccc137-d695-52af-975b-e8a415e0a58e", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:689df6a5-afe2-50ae-8745-12720ce08fc1", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b8d33b6-f561-5054-9d3c-815b482ab7d5", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aa760aab-5412-5f39-a58d-8df10fee01c9", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cf29b13c-298d-56bc-9cb6-219ce41c9c21", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:75caf0f6-0be0-5ac5-912f-8f254c69a833", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f42043d9-34a0-5874-901b-2daceb959694", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:74b72b61-1d52-50dc-953e-13ceaa754742", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a02a5d9b-5121-5fc8-9327-1ec3f4637706", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6bc25c3f-e965-52fd-a5da-dad0d5bf2da9", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a2460567-3270-51c1-af63-ccf58a64192a", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2f341176-410a-5bb6-b2be-bafc0783ef42", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:623daff4-fd9f-5780-b58a-dd7a8c8bf2e1", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5716a0de-9491-56e3-9632-81beb260bc3f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4badd83c-2815-5fc7-bb68-e8757bd727c0", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:15783ff0-2b1a-5aec-90ec-7caf02c38831", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:85a5afea-b968-54d5-b165-75d3f62045f9", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.1" } ] }