{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:99362313-87b2-5283-a1bc-2ac24c6f94f6", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f9a42717-3169-5e3b-b251-5445e55ddd07", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:751bfb2d-eedf-5afa-9d66-d92669135938", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:63ffb91c-09d0-5861-b286-531fc70ba593", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f103dcc7-1da9-5983-a927-5ab27576c98f", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:784da91a-b017-5c56-845b-fa6f45fa584d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a441656e-2c12-5142-9b7a-3f0a147ab561", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ed6f32bb-e981-5e63-b77e-44eda779731a", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:de413add-fb6b-598b-b7bf-66bc6f70a29f", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:89268a25-695e-51f7-a251-d69ca32ab538", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ef1ab88e-0fb4-5c8d-af05-62013db16ee6", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:81334640-bd9d-505f-befb-1e94fb3b0bcb", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d8f8d23d-d794-5c95-b3b5-e02ce6fb3022", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b1a983a9-1f60-51b1-b541-77fd6365846a", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1afb8562-c0cc-5902-933e-2cfa28235185", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f6ee6222-2ea2-5e39-b7a9-09575c2ae762", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b3fb7d87-6a0f-5b01-ab98-42cb9cc43ad5", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-oxm 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:08f5cde9-7341-55d5-84cf-45df898487a4", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2c5430db-d6e2-592c-b74a-c9da318cb39d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d638966e-c3de-5a16-a432-a48d114a2b55", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b83a8974-7c0d-51b9-8c68-6fb267b7e598", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35def089-e820-52ed-b9e0-b3ad44daa0f2", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:65bacb4d-16bc-56f6-9ff4-0ed172eb35fe", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8bb0f6e7-56c2-5053-aa2d-085f5053fe67", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:76cb38a7-1bf0-5b46-b9ce-e1abb10c5b58", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f53c8506-8d1e-5771-b2a1-07ac8826b0a0", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3210a4dd-9595-5395-be0b-a1c34c9a2b18", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c55f2bbc-ebc6-5442-88de-367af281f6b1", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:90c4a13f-9695-54d1-87db-2529247aa00b", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:85a17a19-93a7-555c-80e0-33bba2bc1a25", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e917ca72-65f2-559f-b44b-67a39d453f5f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:416750aa-ea32-5007-885d-50c9bdba1876", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3d2e4469-3ea1-5e15-ac92-ad3bd2373637", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb0c0fe1-1eb4-5df9-9358-f725f61b9059", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:17dfb89c-c580-5869-9fb7-3b425d6b770e", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:68473d34-e4a1-59cc-8fa4-adb09d92d17f", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c9928b3e-cdd5-5ba5-8a44-50c43ae52f80", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e96a0883-f107-57e2-8d3f-6aa5473be3e9", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:53897ae8-5c6d-5e30-b04f-500aaeafa501", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a91ec3f5-30dc-545e-ba2f-dd971ee186c7", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ffc8a7b5-3194-532c-9dcf-b1744747cae3", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:23895398-c8fc-5b69-ba5b-cb446e31289b", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fec1620f-9860-5bf7-8c11-656db9803e8c", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.20.RELEASE-tuxcare.3" } ] }