{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9b477efc-a113-5659-92bc-8c5dd3cb4152", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c9961a0d-9364-587e-ad05-97b446dcccea", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8e9ae3b0-0a26-569c-9154-3b2ac0796f31", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:81d9a70d-35a2-5157-a13b-ff7e8953afe1", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:66cc297a-5972-5ecc-b5a6-685ec62ef78c", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fed6c7c7-fe3a-595b-a1dc-df21467f975f", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43fe6841-b2a2-5a13-8d1e-be6c0c9e4a53", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:139cd737-e7c4-57f8-81fc-817b32e92cad", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2f6a13e7-074d-5383-aea9-617b20a6b300", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:db6c4907-4437-58cc-94df-8f37ef15915f", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:19b87a88-a45f-5691-8514-1b5802a63bf8", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:716e749e-2eb2-51fe-923f-d0788f28eb8d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b5488bd7-537e-5395-950c-8ebe98290805", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a09daca1-99bb-5dd4-ab79-91ccc5ef1cea", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0929aa1c-6f78-5b63-98c6-a56ae1eff748", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2debb38f-565e-565d-8a44-1efc3240262c", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:492923ee-d303-59f4-80f5-6335e30f631d", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:20b4b064-6163-5e5a-ab52-1c2b6dd352dd", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6fe81c76-91ae-51bd-9a26-c8e40dd17cbe", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d9aa1ca1-9c5f-5bcb-a38e-098aac53c02a", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8da35982-1de3-588d-a568-f1f946a347bf", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:88f820b5-2464-5c89-a1bd-8b4b6561aa65", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8b440629-4d1f-57ae-a18c-0139d17df2d9", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:58b377c1-8c3e-52de-850d-83daeec35da4", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:71be7f34-b7d4-5a68-a87c-1714c6d16dd4", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5faf8648-fb09-5a7c-9ad1-d82161c7b622", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bc86c26c-fe0a-5fcf-9b5b-bdc8a42a55f9", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f3b9b2fe-b476-5b81-97d0-a6c2365247c9", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c43bf93c-d3b5-550c-9d9f-847b024362ac", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4f6bc4ff-09b2-53cf-a471-813006acfcce", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d03a3a13-306d-5536-96b1-260b7c155fb2", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43e8a703-79e6-5622-a137-510874596817", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c4d955d8-6d3d-5c4e-9803-923ec0ed788e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8a65c1ee-debc-5cbf-b449-a1d366d57073", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:612edc80-3923-5c5f-b873-d61a6b6f4be5", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:efd56d85-4cb9-58e5-a1d3-6000c6d41ad7", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aa93a82e-4da4-5a59-9b69-de9bd2a4209c", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7d2dbcd-846b-5aaa-bc79-ac73f2191b67", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6fa54958-1c75-566d-8af4-c1e45c0bf061", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4425f3a5-1ee8-5fc2-b3e1-820ee6790be1", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:884f993a-01dd-5819-9a1b-4e9a75fed4ad", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f1db14ac-6b58-5224-b4c7-0e2ef6f6c955", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ef04c9d4-6d50-5ea5-992e-5c59b9a4c788", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:272d6554-4b89-51b8-9df7-7bcc4ea9d514", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.5" } ] }