{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:df72a827-65d7-558b-b05f-6acfa7289ecd", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b3a4ab46-0364-5e9c-82c2-4d0ed87cb80e", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:02e2f30a-7eca-5cdc-ad76-31775686f238", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:74f7c83b-798f-5185-9569-878ba3e5f1bf", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f0002d9c-6a8b-597c-ba5a-480635c88104", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:92037bf4-ef20-51b5-b724-b7e2edf51472", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:13a60296-0c0c-57ac-81ec-5c9dccf5a2a3", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9a8056ba-1290-51e6-8f65-eac212a514b9", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ea159268-82a9-5fa9-bcd8-3f21ff7a6cb4", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4a9e13ee-1fe3-501c-b17f-6067d0feb89e", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d5631830-2ea2-5929-9bba-19cfa9fcd120", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b08b3317-d88d-5c5c-aaaa-34b4f0d690df", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d56b96ac-cb4b-5a0a-a3dd-67c559809e32", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bb0094f2-edbd-5a0a-af3d-f3aa029ee89b", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7f9af96e-5374-5658-b5e5-ecb225910764", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ddfb28f4-0f71-5dce-9807-e49c38395b19", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:42394c3e-4601-5f84-bb76-d2e557a2c094", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:076c02c4-4e47-5b3d-bc6d-85154fc9c94e", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3efac1a9-a448-5ceb-b59f-b8466eb26d5c", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fea1ee49-b5d1-5a8a-a580-cbbf88a36c9d", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8b6f7a44-09f3-53c2-bf83-6a898db7114e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1b5590b2-e400-5c9b-a419-beb81fca0f87", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5df8d9d7-5e15-52ae-bd60-dc4f6a35b892", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3556f220-aa53-59c8-99d1-4c926ab4699c", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1b9c06d7-728d-5c9d-95ec-56aef7f69c68", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4f90a929-57dd-5b77-8aaa-45d30bee263b", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:748f1997-670a-56d1-8201-bda16466fde3", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:069fadee-3c63-5a68-9495-c4c4fec86ffb", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:07bec14c-face-5511-a291-8576de7c16df", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7dac429e-260d-5ba3-a284-8e0208b49a87", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9de3779b-6e56-5f48-9572-2072e1ec79c9", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:35dd4212-4a60-5977-bed1-bf1392d530af", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1513eab1-f459-5887-b39a-f8bdf9e1a077", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a2692a14-9a2f-5451-8b00-15598ebdeb81", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:67a6e522-a11b-5722-8cb2-4e1d442ea1f4", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ac0db58b-3a5f-50f4-909c-5a58672c345b", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f44036f1-0b62-5867-88f2-8f4682982261", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b06a1c54-d530-5b23-8dc6-0b8a53d53b1d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:02a00fc1-7bf1-5ea6-9c88-57cf5537dcd5", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:358b0e63-55b4-5f87-ac7f-5edcf50d420b", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:06226523-93c5-52f7-b07f-b18d9b7c94d3", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1d3bd03d-e91d-53c0-83c0-2d4ff798f0b9", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:91ed1af0-99c0-54ba-b1cb-0ad8df9852b5", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d982e368-7811-5461-94cc-dd9b4d67ec48", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.5" } ] }