{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:85994974-c25f-5d99-be6f-8a00ba84ad96", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6996f0ff-ab32-537d-a997-27bb4e90d7aa", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:24de0cb4-3c9a-5f88-a88b-0ff82e7267ac", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:889ba2f9-936f-5f2f-ad18-ac4dfbf5ecd7", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dcca3899-95f3-5396-b55e-c0e5e0013802", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0c7c405d-7664-53a7-ab92-f905459b1616", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5fd46485-9b3e-55d7-8ecb-5f86af1b34af", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dfb25644-91cf-511e-afed-004591596bcf", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8b5922cd-20e0-568b-b107-f394488c1c0c", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0690e6f9-2701-529f-8e8c-f345dae0ad9c", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:eb5a7feb-1b22-5a17-9025-a27470829735", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1710cf90-0009-5301-9943-d5c6d25acef9", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f09cb4db-7880-5de4-993c-43ad88c22918", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0fedb5df-7335-5fa6-832f-a1aab690dc1c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d9de47d5-bdb6-508a-bec8-ef751d9c33ce", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bdaee468-4c6d-57d6-9fbf-3dd536e1b363", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e1d40406-603f-56dd-ae5a-1d0fd93f2299", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:143a4002-8542-5463-bb2f-3390aa02ace3", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1d0ca483-18f0-5e5a-ae5d-84d61092e9e1", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ee415c04-1be8-5ca8-92cf-0dfdbe192172", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:647163ae-a622-5221-849d-7b18e8582c9e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:eef181a1-f335-5bd0-9b84-5097df9b6432", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a21c5806-c35f-5dfe-9982-aa2fed70c756", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:eae119b9-bd49-5388-b7fc-1e09fea1b4b8", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9588aa02-76e1-5b50-a543-02b8938ca239", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1bd2bb35-1feb-5ae9-a84e-ff63825bafa7", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:50e6e1c7-4b3b-5b59-b754-6efccb17a85e", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:01dd9219-935f-59e8-9462-2b5dad04fbab", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3bc6380b-a12a-5ba8-b027-45054063d949", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0eba444e-3f69-5c9b-baac-1b0195588f18", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6758796e-a2cf-5d94-8cfa-bf599e5399fd", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8c97f44b-8a38-53d5-aa29-5e42a88df2ad", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:280851dc-1415-5b28-9b80-f5757994bbfe", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:84d26f14-a558-52a1-b79c-b16716b6f9ad", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4a3a05fc-94d1-518a-9072-76864fb4bfde", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:11409dff-a04e-571f-85d8-b9325613b67e", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e401ac17-d0d7-54bf-a064-ecd1db690a7b", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:108eb16b-9684-56c7-9a79-d2f324f8370d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1bc3f918-e534-580a-90b7-791c33b6dfca", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b9ae8da7-ff59-518d-84cf-0a279b29d3e5", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:058865aa-dc23-58e4-b03d-b5fd88c68c1e", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a9a72d88-fb76-5866-b451-03709ffa9c7a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a48dbd52-3e49-5061-9761-a03e7f3232a0", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6f0e1c85-0cf6-55be-a097-fd1cd03abc9a", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.6" } ] }