{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:58ca5044-fc7b-5ade-9484-bbe6198cf229", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.3.39-tuxcare.17", "purl": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a8e7e493-1f99-541a-a82b-5143c0fc5110", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:4e86ae5c-4301-582d-b417-c81863a97bdb", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-jcl. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:4445a801-9caf-5885-92cb-f71f8c2be483", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e28250b3-6747-58ba-a1cd-675df69060d3", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:75e5d6f3-56c9-5868-b115-eccfab303f6f", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:859f9aa6-8b49-53de-9322-8ecdee6a98b9", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:74f8a3dc-0437-5e94-859b-7140af8b8d21", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:45417318-8c59-5aad-873e-f63c8739c5e6", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jcl 5.3.39-tuxcare.17." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:5f385a0d-a978-58e0-aa25-b596f915ec7e", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b5887e83-1252-5a0d-94c2-0092245ea3f5", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:89d5934a-2342-5b35-a583-25dd760df633", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:cd0c75de-b197-50ca-b6bc-1abb0be5b84f", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:63e70876-17c7-5eff-937a-0124ab244381", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:fc861664-5373-5d45-8bdf-973c592304e1", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:8449c806-1d31-533c-88dc-a3325eb6d4cb", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:422f481a-0477-55e4-b346-a63be3f8ec2b", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b9d7229c-3250-5242-9782-bf960fdbb771", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:d406a246-5ef6-51ca-b87a-67040f94dd2b", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:62b5c45b-d8bc-58c2-bffc-8d8eb8b89754", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-jcl. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:a44e90c5-946d-5358-a839-72542335e3b5", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:73eebf65-2d2c-5d61-825a-4dcadcbb09d3", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:82981bac-01a8-5d94-b9fd-6818946fccdd", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:d0ae184f-1b3e-5114-8514-ce79d88e9f4b", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:14b5ddf0-2be9-5fd6-9fe2-d585c9c08e31", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:7ba49845-efcb-5d9e-9559-f149c7b0d3c5", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:57bedd79-a18d-5641-8a0f-c89dffd98a64", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:ad1cd4f9-f540-5191-8611-0e145f334bb3", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:6091acf0-54f1-5934-9e0b-4455278f576e", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:1cf196c0-6ed9-5e73-b06a-3e6d94309efc", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:668a586f-eaba-5b68-89b7-db10464a67ce", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:f9aa4d12-436d-5627-86f5-aeb633aa0990", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:741565b1-87a2-5537-bbed-2e95d12a78e8", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:880cb4e3-c036-560c-bb8b-4b3f847f80a8", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.39-tuxcare.17" } ] }