{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d1bf962b-ef74-59f4-9819-63acb834a016", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b5a38b57-38d4-592e-aa91-383c52c1dfde", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a7ae4c66-804c-582d-ad18-0b7794187fa5", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:88dd5ece-689c-56eb-abcf-1fd09d1a4e21", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:74ab2363-4819-52d3-b7a5-1be987c82409", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1c8c9799-eccb-54fe-9247-3b7a9a19b1b6", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0e436498-0421-5ed4-8c77-dd15e3f48fee", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ee3f106-9c78-5a73-9c16-014b28d0d87b", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1d0d0fa2-ace3-56ea-951f-989c4f06aa70", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d68dec50-d6f3-5785-bd77-c4501a62b403", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae1dac6a-8efc-5a09-a92d-c68b831c5e33", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7f12ae4-2cb1-52c2-b72f-439aef3dfb0b", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7833b3b4-c8b2-5cba-9c73-147cfdb62e14", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cce3f4af-264a-5172-94df-2ca59ff11ff2", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da79bce0-c38c-5e1a-a7f2-47439c3f80f9", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4786861-8117-5488-a2c9-87b3b1867bbf", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3ba1c5bd-3bc4-55de-b5d8-f1305ba18fc2", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-beans 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b29693bd-c381-5dbd-a044-30129274bcac", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ab38451-9469-5057-bf91-76a852f2946e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4e2f0a82-e157-5616-943a-f90977f99b3b", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e0be795b-d58c-5843-af18-d4fbf5a392b5", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3c1dc049-bd01-50f9-9721-8ba0ed73eece", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b4d9caeb-1e37-5c6b-8983-1970e919b3c6", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dee74c24-4dc7-5fa2-9043-d0a2c169a364", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1050db34-9e1c-55d6-9de7-4a3c39fb6814", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:525d81e2-ae4e-5bdb-ba36-d7b6dcd3d2e0", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aac7a1b3-f381-55c3-a283-f1c3cc9f6a0e", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c3fd1a9-58e1-5db2-a2bf-ce93693a7b7c", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4254449c-d5f4-5a25-b605-0986f74ebf08", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8301f160-8165-54b1-9831-a49ebefd5826", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:beea87f2-59a6-5761-9cb6-a0ce5d7cc0fb", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6f1edd5f-45c5-5401-8f66-1c5895df4528", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:556d49e8-e0a5-5f2c-940b-f6e7d4912e24", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bbd9f343-ea39-5606-ab31-a1f23b57df14", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2758d45a-f624-5ef9-b8ad-849ac485a0f6", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a7f79530-4e90-53b2-8426-ed93d43b21b9", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c83a83f2-009a-5add-b2fb-33acdd1a9f13", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0c0f3f0-c90c-5a4f-a46e-e4e296c20830", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8b5e3dc1-18ed-500f-940d-342ab6446a96", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:02208dfa-766a-5ada-b93f-0a11e7565f4e", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:90b1073b-1e5b-5dbf-a66d-edb9169ed571", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d183d3a2-39a2-586b-b2a4-c80d61cdabf8", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fe31df69-db6a-5cc9-97ec-ca3388c1798a", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.1.20.RELEASE-tuxcare.3" } ] }