{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:da8cb7f0-2eb2-54ce-a82a-9ff6254178cb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5b717d5a-fe14-5d68-8f51-f1df3ee226fd", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:59b1f7a9-02ad-5db7-bfae-9d13e199cf2e", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5fb4127c-1cc7-55b0-bb44-16836d6048a7", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:075f0d0f-1374-5418-b1a3-c8ba98dc62c1", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eda44875-06b1-5673-98ec-c749f076260c", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6c2a02d5-a405-57ed-9cfa-e87571a278fc", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a43ace1d-5454-5cb2-94f1-8a032e9fb972", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2f2db1b3-aeaa-5077-95c0-f956bd48dc60", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a9378483-628c-5e57-bb93-06131f5c6684", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:918f13fb-e261-5876-a75e-2677472d73e8", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:27f65bde-93ee-5261-894e-aa7285821ba4", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d241f547-ec07-5c28-9c3e-1632073281e1", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e5f95afd-4a01-5334-bff1-7c305aaebfd6", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a647f9fb-e143-59ce-be28-257aed6d88de", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1013cfef-3f67-526b-9ffa-081be8783ddb", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:db18c27e-4936-56a3-9e30-3722ac924c05", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-orm 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:01cf711e-7866-5cd6-a8c1-5c518bd60112", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a8587d76-4415-5f45-8278-454d0a691924", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f910beed-abf7-5fe2-a4a3-703f3a74eb01", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:593412ce-df85-51cb-b92c-5bdca3ff2abf", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ad424fa-04b9-5416-b07c-66aec8d1919e", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0453fbed-d512-52f8-b3db-b8cae8a27648", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d08ff9f9-347f-53bd-a10e-c509311c42c3", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a290843a-bcc8-5576-b3fd-a4aad05da5fa", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:63a6d787-3ae0-505b-a2b6-e6abdb9664f2", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6bda44d9-1cd4-57db-915b-5f4719c818ad", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5ca5f0e1-8e63-526b-bb5b-0fa9cbd56fd2", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b2b72d5-64b0-5504-9655-29a7932edbc1", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a494b6ef-3206-5b85-8e05-830d59cc8b49", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cf540199-b165-512f-9715-6e0b525793a7", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b9719ac0-7d87-59a8-b292-995ed96a397d", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b1f57d2b-ea2c-5e5e-9342-e29c75bbdbdf", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:18d2ee84-02ca-52cf-8346-1075de60af32", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c3bbbf7-9ba5-564e-82ad-42a76c425c24", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f534bb43-2e7d-528b-9557-fc76686422eb", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:edcb4bcb-538f-55dc-b23e-3d861400f9e7", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c5123ed0-79ae-5ae2-ba9b-9fd64e9521a7", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:13571c72-50ff-545c-b56a-46b5eac309f6", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ad58c45-b7a8-5437-aed6-e880519f9f5e", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:423ddf8c-1d6b-5bca-8ce4-b20231f69d1a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:18db28f2-3be9-5e14-9af9-1c52ea2dda5c", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a81f0a7d-7d81-579a-beaf-36832dad867c", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.1.20.RELEASE-tuxcare.3" } ] }