{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bc3a84bd-5d70-5d42-805a-7ff3d31846d6", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:14f84a84-17f6-5b84-a0d2-624c8b595e57", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:50ba7380-f58d-5be9-a22e-361567d3d450", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2292736d-075b-5dfb-8029-0919d4c1f118", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0b77fdfb-5554-53c5-9962-7a621e3c0105", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:956d077d-ab7d-5ec9-b3ea-5ba0ddbfc23a", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c195582a-0366-5ec1-9ab2-5f1d86b057e1", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c7f6ad13-f44d-5f68-811f-5243daad09fd", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e01e55a3-75ce-578c-98fd-743c914a8924", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5ffb7be4-b78b-590f-b84e-0f1ff018bc2b", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8236e963-f6e7-59c2-9c31-bb2615c40d7e", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:40a1fd4a-1396-5b54-857c-10e26a51e760", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:21a68a1c-bac2-5446-9f2b-66a4b9e4018a", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dead80b2-7dd2-5438-b808-d39dbc05636a", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ae272f3a-ab9a-5ee6-b306-b585f4a18800", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5a94d51a-1ff4-5588-83ba-94a8e23da9e7", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:42e7c1da-dcd1-58cf-a15b-42ab943498df", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-jcl 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4fee4d16-5196-5859-86bc-111d52af2a8d", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76799993-7040-5be3-a5e3-77c2aea4771a", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:89bd2e35-e26a-582b-a790-9943d1d59c99", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cbe10294-96dc-593f-abbb-47caaaa89c28", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cd066c61-e11b-5ea2-9f68-34a2902b46ba", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8890c136-c22b-503d-9c69-c33a35e0212c", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb982356-8048-52e7-a30d-60e996afd4ca", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:163b9671-8637-5b00-9b42-bd1972f09453", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9500acf6-b840-5f09-991c-959042f405e1", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ea8d641a-9152-5c10-9de8-e855a11157c1", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e860116d-f73a-5235-8b8a-b77327c07a1f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bee30ba6-e47e-5cc5-b3af-049ef47a48eb", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7d6e1ff1-1dc4-5c71-91bb-e32dd1ca63ee", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5ef4c14a-e5f1-593c-8773-dace87236963", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:16f63b6e-cbe6-5502-b6ff-6c58077123dc", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e91c9a5e-d215-5e86-b28b-12404bf89c4f", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c4e88e1a-a21a-528d-b124-2a4a9992de88", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5abbc8df-5f75-5d5f-81d8-d91dfe1d2fec", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:486021ca-6803-51eb-8b8d-6f07659099b4", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d40cedd9-7b1a-51ce-8b6a-6e82322cc6f8", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:762d6025-aa12-54fa-ace1-c6c202bb4f16", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:edf1d82b-be9f-5e0f-a70f-db2b60b194d8", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c05e83a0-560c-5778-bf41-98e1e79648cf", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:402da822-6d37-58cf-9be6-d562f56d030e", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e0db26ca-7932-5bba-bec7-7193aa30cee5", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0b77e2d1-58fe-5156-9db0-5bb5d8f95c75", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.1" } ] }