{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c8effe84-849e-5b83-a038-06c0880211c1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5807140b-a8c7-52dc-bef0-870709d7982c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:abbc26df-92e9-5987-bc2b-e3ba917f97af", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1f6048c7-07ba-5200-b5ac-2acbd4d05c50", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:088a092f-42bf-5f45-97bf-d16d93d67bb0", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8b53af8e-cece-50d0-90e5-ed5b9c199a2d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:06a29307-63e0-551d-a63b-fb26918e8f54", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a6607581-0101-539c-9552-7139a6cf7383", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e3f813e7-218f-5e7c-ab91-f324fdd62170", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5fa5f6e5-898d-585a-8e46-bc0fa6c03f42", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d90ad2b0-7867-5f0a-8617-4715a9667965", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:26789f4c-2504-51a8-b654-496e49059821", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:600dfe27-f522-54da-8efc-6c73a42d5bc4", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:62714b81-ec26-5ef5-948b-ca5aad92e6d4", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f6d32b0e-8df6-5505-8e55-8c4de1438dbf", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:81cc929f-caf5-55c5-bf08-0b7d0c94aa04", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:62769729-0a69-5eeb-850f-44f063de80d4", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b8865695-a3dc-5195-8b08-8ed937199196", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5e1f65af-5a02-5f9a-84f0-7658f779904d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3e9bb3f9-69ca-5bca-af3f-a4458d497e61", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:76770c67-e6b0-53dc-b192-d03cdc070fd8", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9efeb0c9-c969-53cd-84b5-c1c790a90e69", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e8ca2eb9-03f4-51b1-a57c-ad9822489731", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bb9f0ea2-9559-5cf9-b835-ee0fd9f81ff7", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a1afe43b-466f-5922-ae20-1341bdb04198", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2a0eb1c7-cf2e-5019-8440-8979675923de", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6673d885-f7fb-5979-b278-000dc68e3169", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8d856016-b9f6-5475-af83-c5c051740483", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8f3ec6a0-1fcc-5d8d-960e-801f92a8734b", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9c4180db-cec5-5fc5-b9b6-46f259306c2d", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a6d4ad8a-03f9-51c8-af80-72d535764aeb", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8162304c-d92a-5aba-afb8-1f64771cbc5e", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8978eea-0f8c-599a-b028-de30baf7740a", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a0e7e40d-07f9-5663-9f81-360fbc2b710f", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c5bd8b55-4224-561c-b055-863256571e93", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7b08427a-fb77-5549-9409-217d556cb827", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ea40dd96-23e0-5708-a53b-f09b18a5a52e", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0f0bc577-fc09-5a87-8d9d-ef2bc16d307d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:117cad4b-7deb-5a84-8596-12b15021783a", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:19e1146f-064e-51e7-82e2-4c882c9e0889", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2c92c2b7-e46b-5697-b125-a632a33bab8a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:03e41cd4-766e-5239-ad2c-dfbe51eb53ab", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c63327da-ca71-5986-b074-6ac1a85ea3a9", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bff322aa-b9d6-5c48-939b-95afb6c92bde", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.13.RELEASE-tuxcare.6" } ] }