{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3e2a1f32-c02d-5c35-9805-df9cf49bad13", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2bb5d280-8126-5f9b-86e7-7e48924d4c9e", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:900c2bc0-93a5-56b6-9440-d36a4a045ce0", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:150f5ef9-21be-57e5-9f18-78ef84150948", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a82f9a75-3440-5563-8627-2a340785f1ef", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ec1f5169-5add-5421-b3fb-ccc91a04421c", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d946ed25-f2f3-51a8-a670-3c35e07d6ab5", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a7e5c996-11f9-5d04-9895-c786c6bc95ed", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e33b6c6e-344c-5db8-9e0e-b421e5480880", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c4d98e03-973d-5aa6-b4bc-d5bc9f458e2a", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8fe9514-5ef0-5cf5-9ec8-fbded6ef1848", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:33be3f1b-0281-5865-a63d-63efa7f10472", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4405b168-8a28-561d-9a74-3d62f189baa4", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2df6929c-84e1-5da7-a62c-c5331d661365", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d50cb4ce-59cd-5ae2-8d07-0012f92acec1", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e4833fa5-fc80-5ab9-a3db-bcb3dcf671f8", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:80124cc6-6dce-5379-85f0-2fa93799f5fc", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5e91acb1-6005-5c91-9950-318f1f237085", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9489f194-af87-54b1-9311-dff8b8a3d675", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3b014036-935b-5a34-a1c5-e5ab8918e8d9", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1c321895-d850-5186-9aec-5517871a4e8b", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a08f24ea-c087-526c-b301-9a82ed399a08", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e819a405-725c-533c-9dad-9d7f627e91a7", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fe4b0e3c-95ec-5dcc-b219-79e07fd0a535", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:aca7b17c-3907-550b-a1e4-6703b7de5dd9", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:80007a2a-404a-5064-89fb-310951c7adff", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cacf7761-07b1-53a7-aedc-7c00843d263c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e70dcc96-f54e-512e-841a-efa0873812af", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:18b45a61-7a43-549a-940e-7808f0590653", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:822db299-09d5-5fa7-b9d0-11899ee0ec55", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cc85ffdf-fbba-56e4-b1de-af7f70c4f590", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:caa1b505-965b-502d-8746-0f2c11ff6291", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c3f0b5d3-f769-5cc3-808c-6e0750c25d00", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:66b45c21-20ee-529c-b9aa-62777dfb2bc8", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fecf8b7d-18e0-5605-8c09-90ec599f88eb", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b93e31a0-f94f-55a2-8904-198d6b5b4baa", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:01ab484a-cc49-5e6d-bec4-593a11d1174a", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:11c437ff-0e39-5376-a9d9-ae4c645e3496", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:75e27889-e4f2-5d0a-b1e4-8179a5982529", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:03ee8e4f-4f7d-5459-95a5-973b6f8ace67", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:84482665-7fff-50aa-8d5e-6ec5aba236a4", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b1a04b51-5f80-5401-8a70-692c9716d9ac", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:65c53b15-e637-54c8-b0e4-6ffa5ca77cd8", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d0de3b16-49dd-5bb3-b867-a22d7ddb9392", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.13.RELEASE-tuxcare.6" } ] }