{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4787d929-6afd-5627-905c-b8f4cef8de6f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-tx", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:10013422-7532-53ee-b569-8fd08c6858e0", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4951060f-53ad-51df-893f-54655c953ab6", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b331bc33-df7c-5be5-8a20-6587e59361ae", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:59736741-9a8b-5117-a3f4-d8886c7096a1", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c127dfaf-dfeb-586c-a092-f21801051b4b", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c2e0a0be-ce0b-5906-9333-24786c17fa08", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c49ca444-c96f-5886-a63d-9588b4ee1f19", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ab84ff0f-7caf-5ece-8020-dd0aeb9f99c5", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:308aaf43-7ff0-5785-bade-51e5c4fdfe22", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:46eb243b-ad3d-5d68-99b6-5867f395788b", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d60fdcc1-c5c8-53a4-9254-a2ec161d29dd", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:91042733-0184-5c52-bb0d-61bb52a46b2f", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:70c71d8b-55c1-551a-99cd-7884a46c377b", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:88f6f90b-942a-5165-8f7b-fe87eb5778f3", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:26b3271c-1795-52f9-afee-53a81d443542", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce2c3aba-9222-510f-8982-b63cf96eac24", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5462a4c6-a561-5848-b719-c5e14c4173f1", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c14ad4a9-9a62-5326-b0a1-bbaa61fcd7bd", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e176af6c-a6c7-569e-99f6-315c0780ebc8", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6cd8ceee-bee1-5a55-b18c-82bb871dc652", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a8e8ed41-890d-53e1-8f5b-972a4046a3cf", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ca6db942-ae9a-5383-96ff-1a332a8a4e2a", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d0bee414-cdc4-5d00-989a-908159dc7951", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eabf0692-b1d3-53ce-ba64-1be15bee1e12", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:51c748ea-8cf8-57cd-a0d4-f81b4a95aa2e", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7eef1682-cb00-5b69-a408-01a382192eb2", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0b15b4e3-d9ff-5b59-94a3-58c32b1282f7", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:13faddf7-34d0-5c25-879f-714b207252eb", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:86342449-a92e-5e27-9ac2-9761fdf203ab", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:26c19923-ac39-5eba-9e05-e1264fee5957", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce97a0bf-101b-5873-a33e-fb5d722a368c", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d520d0ee-d904-52bb-9d3b-b6eef0ca9cac", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7eea031b-289b-550d-b354-91f54764901a", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:240aedd2-fe50-5ca5-82e8-e2419444fca0", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cd161245-a2f7-52b3-8dbf-c2517afa3793", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3d2f34ae-a632-50c0-b7a1-b75837feb3c4", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bca84584-6a13-5be9-bd9b-f3c8280f2cad", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5e90b103-b7af-5427-aeb7-7b49b49b1dc8", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:88d7b2e4-142d-5097-9576-93bc3ff8d7ef", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9e323a4b-07d7-5a6e-b6ba-c454cda592e3", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1d97e468-b50d-58c7-b384-ea78452d5ff3", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:28fec656-fa23-53a1-a729-56e23b1a2c81", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a48de0eb-a619-50b7-a013-7bae5f657061", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.13.RELEASE-tuxcare.5" } ] }