{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0699c40a-fe9f-509c-be4f-1daec5d1ead1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0ae62edf-d4e8-5821-8823-e05701a01fa2", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:06a8037e-e8b2-5000-a345-01b7bcdcd6f5", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5a28b9c-a700-5e99-973a-e2006f9ef409", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:36d7bddf-f747-5a66-b387-3f81e95fa6ea", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f94f73e-0cb1-5b8e-a4aa-92fd1db112d8", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8a5df56c-c6c4-5d4d-9bf1-8d886e4b32f6", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fc717734-41af-5679-9fb3-0bb9048b032f", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e6f72724-6a99-5344-8ac6-c4db7bb36d28", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:654b4959-16e0-5b9e-97b6-c9e09672163d", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aecc36d3-7cc3-5dd5-859c-b8b1c9393afb", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e8e33dc3-8f4b-5661-93db-70034bdd63ad", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c957c246-bf79-5e5c-8067-317ea28bf229", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aedd6f4f-617e-5972-8578-89417173e7c8", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dc72cb00-fd25-52e3-80a7-f1701b7b9757", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dcb54394-ec0d-57f2-9dc3-7dd51a9fdb92", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae5ed6e4-0fd7-5d3b-ac83-d4a0bc6d1003", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-framework-bom 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:de1f9bd4-a457-5897-99f6-e71967d31a0e", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:002a45f1-4d86-5da4-9058-71f6d0698fbe", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f370cc6-27e3-53f1-b20f-e37abadfed47", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6935fce6-d12e-5917-9238-a810d768a11c", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:260973df-25d3-575e-8046-ed103f50f4a9", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4d0adf94-cd2a-56c1-a04b-c20d9d095b6d", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d08053f1-02b0-509f-acab-4cb9009d1174", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:401539a6-3c3f-5730-abe9-74efbd70986e", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e5df5b03-9704-5148-a05a-a0063c8672b1", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:83edf218-1d4f-5a2d-b548-ad5832aeea23", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bf266f27-3427-5a34-97c0-d437648b8ea5", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b5e21292-146f-5362-afa0-34fb6eef38d1", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0cfb3f87-d040-5254-a2c0-856e9c507a53", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d2950e92-efcd-5b3a-9005-4cb5cd7fb58f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:25073a86-8492-52e2-b93a-b90e8ba793af", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:84acdb9d-7f4a-5d1d-9442-63bb7a38919d", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:79afa258-ed18-598d-a5ad-7d532d06598c", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2c58cff1-09bb-5b8f-8281-f5aaba9bc9eb", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d863de61-083d-5dd9-b7ad-49a6069e55ad", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7e54a8ef-1637-588a-9d17-d75cf4a8235e", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cf945983-2776-51fd-9a3c-0744793fa709", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fcbf0240-39f1-523d-b7cd-c9a98bee7763", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7bf79589-5dd6-5c2b-b8b9-8c0c23248141", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44564a33-c702-5429-955b-aa0f054a3799", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:56cf7d4a-b81c-55f1-bb2a-aea5e617b038", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee4ca9a8-0a05-5f6d-ac2e-731cd169816a", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.1.20.RELEASE-tuxcare.3" } ] }