{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f076857-dbe7-5f8f-9225-a94255029897", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-aspects", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:030eb57a-6b46-542b-870e-eeaa20b15ae7", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7b45a279-943c-56d2-96ed-b4c9045bbe4e", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c69155a1-6a1a-5dc5-a25b-27719e5ef2e8", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:67e3cff5-6eb4-5675-b18b-ee5853f9c556", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:219a4dfa-17df-5fad-9f26-84206526313f", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e57978c-c917-5765-8936-ec54f511fe9d", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e971838a-3305-51a3-86e6-c6d3c6b9cccb", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:49c81f07-d21c-5f04-81ea-ba1fdda329b8", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:21605b72-d346-5df8-bb3c-21ca97b9fc44", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:918803d1-8944-5484-80f7-a4d325943f85", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:79c7e53c-0920-5654-9394-5ea11993b038", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d81ac4e8-8f9f-532a-a89e-16057312379d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cb8259fb-cd10-5980-b3b3-92e5a4634025", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6bc10bc6-6050-52d8-8c5c-bb3977288787", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:141d518c-c968-5e47-9b75-880e578c21b7", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:926889ea-eedf-5fd5-a376-276861152969", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-aspects 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4292464a-4b20-574a-bac7-e61883cfdd65", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ee0c974-ae5b-5dad-9983-34d67472ada2", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:446ce769-b3f1-5511-b62b-90d834000aa4", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9cb90967-6eda-5811-b19e-7d2f4dbf943b", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41400373-d14d-51ca-a6e9-812f0cd071c3", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:83d167e5-67e7-509d-aaff-0e2a4f763af1", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:079c103b-6eb1-58d8-b93a-da7cc81a53d8", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:85a395dd-dc14-5b7e-bd59-95f8830210c2", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:84f63eab-7110-5f64-af64-97c250baed27", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb4f382b-beef-5566-a6fb-d625b5348671", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d67b9760-dbf7-5015-8a9f-4b020b6f852f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:53ab0c6f-9a49-5a07-87a6-9759caa98033", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:12c3559d-04f2-5f29-875e-0e30c4e501d4", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:032207b8-ea00-58bf-8c56-a9c38538496a", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:771f157b-d566-543c-b48f-a957af6e5388", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d07148c0-c086-56bd-87ad-fef3f3313a9f", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:191b473e-9b03-540b-b852-b75b99654ed4", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0165c497-872d-5bf3-9c84-13d7c14aa723", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d3ea70e8-a117-55a7-9da7-96ed1726c2a3", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:debb5bf8-fcb6-55d0-b540-e0235f9dee6a", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3c9f682c-51f5-50a8-be6d-30a23c7d3bb0", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0df8c53d-ceda-5f70-b0e6-fd9ab3adaa9a", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:352b02e3-80d4-55fb-b4d8-bf8c66882512", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cecf3092-2e06-5f38-8b85-03bcb3e55183", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0435ee53-21e1-5a91-9bf6-1f136873eea0", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:edd9c6d9-cb37-56de-b855-efadbec206c2", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.1.20.RELEASE-tuxcare.3" } ] }