{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:71759892-242d-5622-aa95-c1daf8c255ae", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e2039ac5-45d4-560f-9d03-6dd8ea21c294", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bfd1d78c-dde2-5ae3-9c7d-e5016e1cf383", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:18151e09-9cd6-5db2-a3e0-927f3394fc10", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:80cf1dc6-5c8e-5f1e-b126-070274053e7d", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fbc4537a-dcf2-573f-8121-dfd3d72ddcae", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8353ae19-8ecd-5acc-9d43-bae6462a2963", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d4b3546f-74c2-535d-ade7-d7a583a5ab18", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:46d03d29-fa11-5593-a559-553b9d4091ac", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b6a5100b-a4c4-5d60-9882-c877e7cfecad", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:51d26ccc-5bfc-5599-bb8d-a013292c35ae", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0a2e8a1b-22cf-5ce4-81d4-66338e2aad39", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:208d7193-d799-50d1-a9da-fc3bd375428a", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4e496ff0-4527-5557-a882-909995e89d9d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2feaa7b3-c310-5207-871c-f71ecbe32917", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:83b6d46b-328d-5d3f-bc3c-fa3e990ee64b", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:571d311d-d70a-55a7-8f30-ae4fdc460592", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a1033194-c29c-51cb-9c7e-e811229ecc43", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7e7f7d1e-0484-5edd-8438-3763aac0a7b7", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d51f58a8-71a4-59ad-bd89-96a3efeab8b7", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1b8d8c08-90d1-580d-99c2-40727f371c34", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1a9ff082-d4b0-5ca3-9639-9e38e1554084", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8eb8f64a-d0e3-5c2a-8daf-44dffee199b7", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6ee41a60-719f-51fa-b35f-3f3b2f18913c", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ed7aa081-a7e2-50c6-93a0-9afddaa15c00", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ababffa4-0097-52ea-819d-77276305953b", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:89aef5f3-6bdd-5110-acec-1e505b3b52d1", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ce756d84-6344-5f59-a05b-e6f33f096b4b", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1445d303-90b6-55f9-8303-02bb592f8db6", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:087dd5b1-5348-5f3a-9931-79a3abab27e6", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:01b81bde-1dff-5421-9735-7c201bbde43d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ffadba84-a556-594b-a122-c1c316f31e06", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:23c25f23-00da-5ce1-92e2-dca741c826ce", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7ae90374-0bee-5f3a-a6b1-df23ccb94cbd", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ec28ced7-da0e-531c-8a21-5ff2258d9096", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e605aafa-5e9f-53f2-9f08-5946410eea6b", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e2f28038-c133-5702-ad77-4f081fa28f09", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:824cd4dd-9c6f-5e4c-ab3d-495a2932d738", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d55d6e7d-d717-5f90-9d55-baac4e8559b0", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c040dc81-8ec0-5ae8-94a1-f9a13fd91f5e", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e465c297-3596-5abb-a206-6da8c25fd688", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0f0b7024-131c-5971-98ec-77a474c712ef", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0f1e44b2-06e4-5a1f-9519-f950a757ee19", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8aa1d333-fe1e-5ce9-b7ac-54fca4a1eb29", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.13.RELEASE-tuxcare.6" } ] }