{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:267825e8-a477-5fd8-803e-c25d3cd9bac3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-tx", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:709b07f2-16c9-5ec7-8e52-b12e2c76664f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ddca9cb0-382e-5105-8aaf-2b696b2997db", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a27b40e-9073-57f7-9535-91a87de21270", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b9908223-376d-561c-8c7b-d9f56c5bb299", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:72ea0e28-64b0-5f1b-8e99-cfc41e93de6d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:978e2e19-45d3-5c60-ab13-f71f7383d9bd", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2402842f-4001-5a91-8190-4a2da0d2a9a1", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a8576575-655e-5a27-8c4f-eef36d70efff", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:390ffac4-8c17-552a-85ae-9d7becdf5cac", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:19aa3e42-f2f7-5e9e-a116-7ef342b489bf", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6621a8a0-8144-5485-8488-052b500590d1", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b58380e7-c3e1-5861-9ece-54f2c3dbb98b", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:669ed436-aa5d-5b5d-bafc-2aa4b8299f7e", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:357b1e4c-105b-583b-9e49-1ff2e0d70e0c", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bf697bfe-33ce-596b-9084-f6fdf7463d49", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fea7277b-6b56-5207-b08d-165a67600fc8", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-tx 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29048154-0186-5c33-a7f8-dd2d80e69250", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:873e9877-f618-52d1-872b-cbdd7f91fac4", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aa62fa8d-6bf0-5b9f-acea-5100d7349952", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a398445e-8444-5fea-a97f-162860735f7f", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c868397c-9c96-5a9a-b0cf-bd9adb9ffead", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6fa8c3fe-febe-50de-a3ac-68ea165354c0", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6c0a7362-05c5-5c66-9597-6ac3e4b0b449", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5d101c38-4797-5394-bfe6-40f228a9011b", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:172bee8f-3f7a-5059-ac42-d784e17782b5", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0fd4ae24-7b85-5810-80eb-309470e09704", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37b67269-6b30-5b05-af04-07085e94c45f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:784ca8b0-82c1-5aaf-9848-44de772cd1e6", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5edc2df5-b594-5f03-9796-dcfbf886d871", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:45ce00ea-46ec-5a76-a69b-67f16fd46143", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b7f5167e-9657-58b1-8055-e695f1213077", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:04b4a53b-ce6d-51e2-97ad-8d1bd84f0d7f", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aa03c562-e41b-5e60-ae53-b41c857d7c0e", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a0db7fce-02ff-5dd7-8313-08edde11be7a", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f877c478-ea2b-51ed-9c5d-11dc416b2fa4", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a9e02730-4a69-51c1-8d54-34a3b29de1ad", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d60152d4-c8e5-5741-a58b-fc0e00849aaf", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb724e1c-07e7-5f78-a22e-210de234c7ab", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a4ed4173-522c-55db-b1ed-0da1d3d5c712", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:df8e144a-9c58-57e3-b354-f223fe71d2cf", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:232f069b-38ce-533d-bcad-2c0ab7cb46bf", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:27fb0903-8d2e-5501-9ed4-12c66b704148", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.1" } ] }