{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fbf8f28f-2fd1-5c94-a2c7-39abed32fd93", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:60ebbbed-8187-5813-a571-60b57ea87538", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8993972e-a2ab-5991-a59b-30838b0e6d5b", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:54e3f015-4c2f-5993-9bc2-ee6933345cb3", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f3a8aa2-5de3-57f1-84b9-256d16af7cef", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e132f5ea-171b-5e2d-aee7-2fe1d1225f6c", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7712812c-62a6-5334-ad02-7fdbf3be0230", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7373c66e-5364-5e91-91d2-0d1926ec0018", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:25186baa-514c-5b3c-b885-948eaf92850b", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bdb2351e-683a-5259-be64-7eef999f5db9", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:862a0f41-3fa6-54cb-8829-b818005c1dac", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:93b93140-aba4-5f8e-b49d-03af3f6906cc", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7d991ff9-91ae-51f4-9425-3131c11a99cd", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bcba2dbe-1e9f-5dcb-9afc-7a0994d73dcc", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c90d69e1-3e59-591f-9476-6bdee57dfb6b", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4edd2161-eedf-59ab-aeb7-06579682dd39", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:707eb6e8-51af-5ce5-b162-6e03d08c73cc", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-aop 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f2e0b250-f1ae-5186-8b91-879e2b2f61bd", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7480d9b1-76b6-59d1-bf79-00baaf01d44d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e3542a59-75ed-5dad-8a7e-30747a06ff6d", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:896e76f2-2676-53a2-96cc-3909db8434a3", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cdfe99e6-0d2a-50ea-b7aa-8fce1f600d23", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2379be79-4f17-5dd4-be98-af60af1762ed", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8adf386b-4ef8-592e-bce5-65bb580b4fee", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0803e984-cfe1-5dd7-835b-fbfe5b929389", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c1525fa1-442c-5635-8daa-cf655f91d225", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8582ed21-68f7-5e0f-8b1b-622bc67fa9c7", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:73d99aea-8e80-5f09-b43c-d1f72f589862", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:502eddc0-8312-5018-b103-c37245cfc7b4", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:00a2e7a1-41c7-54b9-991c-775488f660db", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:087efad7-b167-591e-84bc-70b2628e774b", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:18fd3c0c-7257-5d45-86b1-975a68a4ab4d", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:716eb9a9-1996-548c-b7d5-b21d47ea71fa", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c0528f6e-4802-508b-8d3c-a020b6b88913", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c6aa1fe4-a40d-5ad9-8e75-8ec8ec3243a9", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f4e93e3-9948-591a-a5fd-090509eaed93", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:20d28991-3c6c-50e7-8fd9-a1de71841b04", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b262bdee-fe9a-5bef-b38e-df25bf801aff", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b0117a48-9c2d-5785-88a3-9739b264f9b8", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bdfcf2ff-71c8-568a-a5ae-9bb309029671", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c5bb0dd9-4c22-57ca-b227-1c3a9e88f1a2", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:731b8d9b-9099-5358-9612-9d705541f7a6", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d42a8530-7246-56fa-9a9d-dd9e28b1123c", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.1.20.RELEASE-tuxcare.3" } ] }