{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c22b3d2-366f-512a-8b87-1047b18359af", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-jdbc", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0528a914-834f-5970-b2c1-a9c227372b8c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:22c9f5c9-bb59-5918-b30c-0bd6473c3630", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:048f9a04-bdd0-5aed-9df2-40e80cd66a4d", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:257e3180-b4cc-5bdb-afe1-013087eaf0f5", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dda0e351-1d06-55e7-8014-11f2ed916c8e", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:33bceb88-e451-5ced-9820-58d7b7c8ff45", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:12b9d11e-a1bd-50b7-bc5e-13d92b73043e", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:27c80165-696d-517d-b65c-55b2c41736ec", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9619a1a4-4fda-52e8-aaa0-c517911e1d76", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2aebc46d-4d3a-528e-bb5c-982a8c5c6e28", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ad3343dd-ecaf-55e2-aeba-9493e77ed407", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ff8accb-383e-53b7-886a-5af060869417", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:99962a9f-321c-52ef-9a23-7b3011bd73c7", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2af27b78-1d1a-58c8-9d17-ebe47c2a2cfa", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e34e76c-2f08-5699-9959-75fa240f9c58", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c11d3031-23e7-5dc6-ac12-88abb40bf5e0", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-jdbc 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cdf138f2-f3c6-5bde-9bc7-30c3d8f00963", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2b696093-25f5-554d-9ecf-31086a40fe3a", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:167dc64f-ced1-5b82-992d-ff96aee21b89", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:20bd67eb-37f0-5b9e-b36b-75ead7843c8d", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f97d733d-baf7-5b76-b606-fb485a1d0f7e", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5563c134-570c-5d54-8a51-be21045f8d11", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba1c6b8d-74b8-5b8b-bcee-21c149a0eaf8", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:37a97c93-efe4-5f5a-9291-7be30366932a", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:980ba926-2814-50a9-90cb-197d29184c21", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1d70ae14-2c39-5b6c-8b42-ab594dc40df1", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:74585f4f-612b-5225-99e1-9eed56965cdc", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a5a65326-f726-50f1-a12c-94c1cddd92e6", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cfed0130-02ac-5e6c-8f32-ac2a5a8c2bd7", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5b865811-56f6-5922-9652-4beee037afb4", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d828b0eb-d195-5125-ad97-7e6c2ddef040", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8d801657-da97-5a58-be07-310ae04a8c05", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5dddc054-241a-5aec-8d9e-3d7dcef7e8ec", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4022fb66-6b10-5def-b4c8-ce7fbf5d9552", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d1e70bf5-9e2d-5eed-bb9c-dc91afa6bd0a", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:957d1f98-9cd8-5c9c-960f-bc7a9c666f1d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e219870b-154a-5691-a1f8-9bee309175ad", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:810a709b-2fdc-58b3-8a37-24eb9a3dff2a", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:588b00ce-b53b-5cfa-9a55-40b881d57498", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:80d967b7-b0aa-5555-a03d-393b73f8d454", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:df64c992-5fff-5d19-8629-fc9a4e0cec09", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5810f0fa-f0dc-55fc-88d6-ea9f69c6e859", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.1.20.RELEASE-tuxcare.3" } ] }