{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bae52e99-c7d5-554e-9783-2271ac2f8b02", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:15233d06-6bc0-57a1-b20a-d242ebbe7aa7", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fe0f7add-dfe9-55b4-8d32-9fb5e1a3f31c", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3721772e-4138-5b88-b3e5-8730deb2028a", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8d59c172-eccd-58f9-9e82-4981185624dc", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e1196b16-db50-56f8-83b1-e62e095ba9d8", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c41ea9f2-6193-55e3-a7f2-92350b43824a", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a9f83603-75d1-5eb7-ae99-fdf909512085", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0dad7e7d-86e4-5e63-a3ed-7a9356413225", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:82217891-52c2-54bc-bc3c-bee60088759d", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1d0be7fe-9284-5dff-877a-6b997d8d92a2", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0f22d4e2-dc1e-5787-ae52-8a7a793c31ff", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bb514741-c5da-5e8b-b280-b4e4279a13a8", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:61f50c70-e35c-590c-bd6c-3c967a47f0c4", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4d58b723-61a4-5743-8907-3d469807f29f", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fdad8121-a633-5e45-ba04-7bba43e7e168", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6d9f3ff6-60f3-5fc9-9e8c-74f743c147de", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e926a8fa-afb8-53ae-91d2-c1d33f1ca88f", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3d3c055d-2e18-57fe-ab70-7cc801ac954c", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:273f5dc3-2acc-5fef-b6d0-e59cace34bec", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:178948e0-4b7e-5088-b6aa-7468906b062a", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a269fc40-32fd-5b17-8fef-b0f0c74a0b4f", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ffa48388-1146-5d2c-abfd-580f3f3ebd2a", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a78e6923-9eb0-5670-ae71-aab9e39a5062", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:84ddf66c-915c-5a02-9f2e-68ae116484ed", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aae3f0f9-29c4-5345-bffa-195922dab186", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:59c8bedc-d9b0-55c5-b177-58ad79c262d5", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eb1c908d-1c08-5203-a2a4-07d7243de0ff", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f870e8af-758c-5594-bcd5-29e3a2329c40", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:69b4074e-6516-536f-ae90-c5263001c21b", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f24da541-b7e9-5084-b44f-ada21dfbf438", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:42d52899-6db1-5bb2-8116-c4eb735cf46f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:db521b9c-e066-5550-aade-8d8d463da048", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7b7ac822-1d81-5ca9-96bd-96876f9b3d69", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2ff50107-d11a-542e-afb9-53ffcb39c727", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:abe74e4a-24ae-5f07-bc19-33fefa10f5bb", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:365e7fe8-be6b-55cf-b194-4662362c5e0e", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d2c23fd5-7c72-5400-a072-89251519b439", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:27bee635-959b-577b-bee8-40ae919f2cbd", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bad6c568-ed1b-5f86-a12d-bbe898753686", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b217fa7e-3f3a-5d47-b379-51d36853cba8", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0b7e2736-60c2-5bab-ba35-3b4e2837bc50", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:682b6593-a585-556d-bdf5-6092252e49cc", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e81f586b-1da0-542d-9af4-6bc7e5ff72bd", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.5" } ] }