{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9f3ef89a-a176-5d0e-b96b-8afe0c2d91ea", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-aspects", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:095e27b5-b1e7-553a-b981-5bfbe77620c7", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b66fbde-d4ea-5fe0-bbdc-c29f50834ab8", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a787ada-01ed-5c54-9352-cbaaffb3d557", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:097859c6-fe25-5c48-9c7b-32ceb9336dec", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:31ded3b6-f467-5f74-a3fb-0e0919989ee1", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:78907430-e106-541b-a5f7-5559df787ad5", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5071435d-af8f-53a1-a00f-de456ded0767", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5a2cac38-12d8-5e42-95b4-f04df4023354", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0a6db440-07c6-5b75-a869-e9c2c4ab0782", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b88328b9-b173-5f83-8069-a63ac2567cfb", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f2e19c05-8792-55d8-b76b-5d9bc82cc4ca", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0e13e7fb-7b72-5013-8835-3cac5e615930", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f0426470-9464-5bd9-b61a-49d31c566151", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d60495c7-a79d-510d-a32b-0679e69b0917", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:88e9409e-1c22-5d7e-ae64-61ee4fa43188", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d2a76567-0e30-5581-a275-9c3ac76d9c82", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-aspects 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cebb1a0b-f51f-5d5c-8b11-8146f0d85a6e", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:711db488-0a3f-53a5-bac3-86629e03db05", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:440115db-0884-5726-8b3e-2ad3dfabcbc5", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:08e94bfb-1498-5da3-9f1f-0f62720730d4", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:38f0a117-ceca-5626-a013-192b94ec5f9a", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c76e6c4b-d863-5ee1-8a4c-ad20c98756fd", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a6219b2-a86d-557a-8cd0-1add6bbd68c5", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90c017aa-7e02-53a4-8baa-81f4d337b9cb", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69e45998-a092-58e7-8322-e7cf9c743ef1", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cfd06dcd-a66b-5403-b45c-5fcfc0751e4a", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:79880a51-78e2-5a41-af59-1ab9e92e0354", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e874cd38-f385-5c09-862c-56d171085da1", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:21f9315c-49e2-5236-ae68-bc668c0f3f02", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ca9564e8-cf0f-59e8-832c-ee3235691723", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1d6b4a1a-302c-56ad-bad3-0fedaf836f37", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2961a281-0fe1-50cd-b179-7510f87a06af", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:da8a3321-48dc-5f84-a155-eb25f8aeede2", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2e913a6f-09b4-5642-a464-894c6d8a6be5", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3aa1505d-e01a-5ba9-ad3f-d1f2ac2a83ae", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d00266fe-9203-51d3-8dfe-6f3541bc9708", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9afa7c39-5d55-550e-b62f-12d5f74e5530", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:15ce95c2-d69c-577d-9f38-b1829a296933", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d9454760-94d3-52a6-954e-a17860eed3a2", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9c23ed6d-f18e-504e-9198-13897051268f", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be150764-d4a7-506e-9064-8aff94255a2e", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1316d94-95c6-536e-bdfa-56093e761d9f", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.1" } ] }