{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89f48ec1-7c9c-50e7-b44b-564c1a8e9244", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9e58bc1d-f2be-5dce-8963-6c7c85fb427e", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:78cd8c31-ab9d-53a9-9224-c80d2fa3d54a", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0162b007-ad96-5e43-88b8-74797479d58d", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:62e7022f-4f86-55f8-85c0-268cf9dae98b", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b5985743-b44e-5414-9da8-c8789d2fcd59", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8be053ad-8024-50c2-beef-1d8bd32f004e", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aa68a4f8-4f6e-54a2-ab4e-011940bd1539", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0e1e80b8-4401-552c-998a-071e597f3322", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9b67a509-c06e-517c-820c-3c21a8d96fc4", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2a825027-1b4e-515d-9f93-e8ed5841c42e", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b1cc344-76c9-5d86-add8-e19fe3d3504d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:953364de-5702-5fa1-ada4-9568ea3ad761", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0dcd45a6-859c-529b-838a-2ef606865a96", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3fb91959-92b7-5b1b-9937-63d4fa44d9c0", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:01f146f1-8b7f-57b9-ae8b-31392c10b043", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd728a9b-6c9e-575d-a885-60c9981c2278", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-beans 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1897abcd-97de-5a2c-8cf6-8310f5234364", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b7ddaa44-2c26-567a-9290-0621febf897b", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a4af392a-01c2-5373-9c8f-9b255f497d63", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:64ac2397-01a4-5c6e-851b-77dee4f9edc3", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b146fc67-fab2-5b4b-8662-d33cde4b0e18", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a14ba8c4-277c-5849-b8de-c8d19c8f7239", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:652dca94-ee6d-5af0-a3c6-5162a95e3ea2", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a30dc0e3-18e3-5b56-ac48-77de1699261a", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:55334842-ea9b-5ae6-b9e7-f9eb85d98b9e", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ff823871-cd78-5e5d-a51d-1f4ce5360fe0", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97031ec6-0e97-570f-8530-25f3376f1c6c", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f9d57f83-e0c8-5ba7-a4b3-06bc9cefa448", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ea6ee2e2-94de-5ccd-b9a3-b7cd39d37654", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7c3097e1-1635-5eb0-83eb-046dc92e239c", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e4ab62f1-be01-50c6-b3d6-07a4524afcba", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7907a492-8833-5ad0-87bd-dd493cfaeea4", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:893ed19a-8b15-5537-b879-7b761f6f8bb7", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5de665af-2458-5300-a859-3658cfb41603", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7441850c-eb4b-5ac9-ae74-8a8003fa5462", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee08b27c-75d3-55a4-8d54-d6352de775d6", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:653e09e1-769f-5fdd-a204-9fea8b294513", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:057153fb-5d0d-56d7-90ba-16a568072710", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6d950168-c5cc-52c9-a853-2c1fa370152f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0089f340-b8d1-5b1b-a97b-8aedc81b7a03", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:613481bd-40be-586d-84d6-40103e2d44da", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d69b40f4-7545-55b9-a4fb-ded2b6224ba1", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.1" } ] }