{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c7724d67-0107-5f71-bfd2-5b0149688041", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7a0ac8d0-11f7-5b8d-94d9-b92fcb90d17b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b23a429-9427-581d-8413-ebf28e06e6ef", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6eb4d241-b57b-56b6-8e67-6489928aefc8", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7cdda80a-5981-59ee-8c69-2bc3db3625ac", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a1ee428-c5dd-5aa1-942d-837ad12623e3", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5d4a94ee-1a13-55e7-95a0-e6ef41fc4e71", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e3527501-10f9-5bbd-9002-790aec5bc0b9", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1369f55f-ce17-5659-b19d-cfbdaad4c6f0", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97d19f94-cd30-5d70-835a-801aea3600cf", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d845443d-4a1f-573d-9f2e-cfb9da52bada", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:52df892e-10a4-5e00-a75c-2aa1046ab77d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:221c7083-a092-5e40-b512-14d4c2b915ba", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e7ca5f8c-8335-51e4-88c4-77f22208dad9", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:45c3900f-2ff9-5c4c-8a04-79e252568b65", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8f6a41a5-b45b-573d-8dfb-967e8783d0ac", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ed48a55d-27e8-5c8e-ac60-6ffaba3d4cce", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-context-support 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b009540e-5378-556d-aa4f-0e83148a6bd1", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6852a3a9-7f1f-5fff-8e75-3376df0c17b2", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:980a06a8-a5bb-57a1-bc77-498f35dd23ba", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e0443f93-3882-5656-9689-057535d44b95", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d1e74d7-bbb9-5618-acb0-e1a3e7837522", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6e568630-5ae9-59c0-9015-e91587a2207a", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f47c5bd-aafc-5933-9804-20865e5985c6", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e677a587-df96-53bc-b8c7-bb79d4ca8d81", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b46f048-6a82-59ec-9a6a-9c77583923e4", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a1745df7-fff6-5323-8067-a0e0254b3bec", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:65537910-92de-5d95-8a4f-4291052bf7fe", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97a10129-dfe4-5be5-af73-837c4d2242a4", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2f6c5b6d-5e76-5cef-8b0a-d91387b04166", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0707ac0a-5bbd-53f1-aeaa-2f8a785d6a52", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0aa8e595-ba2f-5a90-90e6-3a39cf1f604c", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee2fe813-eadd-556a-85a1-1acbf4cdee58", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a44b9da-e668-529f-87d8-6b4cc295f4f8", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:87508ae9-a05e-5f85-bef0-04befb911f65", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cf205174-fecb-5315-a7ce-7b6baa6950ed", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d4a36636-4314-5de2-9a74-54b7845692b3", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:66abcd35-cd7b-5ee7-8f0c-e5fa6bc3fd18", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:84ee8b88-c248-5f19-9c2e-7776a84df317", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2b1c4eb0-0fba-5e1e-b144-4cc9778a0a63", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:99032a81-8349-5c3e-ab5c-7e8248fc33dd", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1bc5d8e5-e98d-5e8b-b808-aba8835fd46c", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9af2dcbd-b775-5aba-8029-eca713993bcd", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.1" } ] }