{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19d0ecd8-fb11-575c-b4b4-9a9dc9a31458", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5b85a801-5aac-5ba3-97e3-e4f6c29ffe7b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:df660aed-49a9-5218-8d4c-7faef5bae7b7", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8009db55-e259-50d7-8d0a-9ef60937c130", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:140d8a37-efb0-5749-897b-f46f3c07b3d8", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:53043ec7-bb35-5b65-9a0d-d7a8af64647c", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:592f8f31-d273-583e-b124-3f3eba37e691", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:699926da-151a-5d3f-832e-6629f51fd6c1", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:17398b7e-e2b1-5f43-9be1-e07c1dcc5003", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7099cc20-896d-5dd0-9bda-90d2c6394f5b", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:abd9e2ed-48f6-5e2a-a62d-3ef757bde184", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:80936547-0554-5932-aa74-10cba3b68dc0", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0c01b1df-9e21-56a9-b777-c0d371f9b71b", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b4685edb-72ea-5a65-9dfe-27770d0409c9", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4723f718-7a77-55ab-829f-5c056da14541", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0fa9251e-59a4-538a-acc7-64683377cb7c", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c37eec18-9cf5-57cd-bd88-14e40ecbe673", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-context-support 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5522ccb9-ac66-5271-8b60-1d64944b02f4", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7dd581a9-b07a-5058-9b87-d4ac974e0f31", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd3fd446-d825-5d7b-9319-32ac8926a62b", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:649d9d2c-5b8b-5ee7-a414-7109929cfa5b", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:281df825-7020-515e-8cfc-36a3a83a4efa", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9aeeb430-3f87-570f-a521-455082bf93c4", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5c67b12c-5c7a-5177-b7b1-9ee1b1bbb7b8", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2a6761b7-ea3d-512c-a765-eee070ac7bbd", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:37c8937c-bb09-503f-9d28-0b9db2c003dd", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:128f503d-adc1-5e1f-ab6e-8bfb43c8126e", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b7d15385-0510-5aea-aa63-cd9900a2986b", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b9be6d0-7310-54cd-a722-9eafc9b279fe", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ac7f01c6-8277-5386-974b-766d9b9ff233", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb850f56-0a7e-57d3-8650-2c59f7886402", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:68efc2d2-0bd3-5bd6-87d9-4ef7cf489936", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c5991cc-9689-56f6-b437-73b101a18a39", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c2b2110d-8162-5c41-8416-4c55e9541a8c", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b0468d5b-f99a-59b9-b087-d82872b855c4", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:012ce1a8-bba9-5304-83a4-511e3fb6fea6", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:71593625-8398-55f1-a98e-a1f6ac57df1f", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7b989258-5dbb-5d58-bd49-3d9681587a0a", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:62f7e5c6-b011-5995-b807-c19a062f5f43", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3de2d2f8-faae-5914-b27a-38af85a36be3", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d6a0a1e0-4da2-5e51-b30d-13e85f326b72", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d1e978e0-6ccf-5268-afda-9309e5c53e90", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5a8ea559-a66c-5769-9496-ce69e4eb1072", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.20.RELEASE-tuxcare.3" } ] }