{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:24d17732-0267-54be-8eef-890d2f7253ad", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-webmvc", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6e437975-ed62-5642-9b6b-f55a6ac775e7", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:62630d5b-d5b5-5702-bf53-0911c46194aa", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ec319b5b-38dc-5b39-89ee-49b9e0bbc1db", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b0254b02-7848-5754-aad0-027879f77580", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38204a05-a646-5654-a2fa-57592c3d6710", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e0d6104-52f8-5e8c-8e8f-d65e1b32d8ce", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae471f85-7446-5094-a4ee-8ba8aa762343", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1dfa82db-47db-58cf-b312-3ba06be46c43", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7fc1eb07-4ccc-56c6-87ca-85159739d9b7", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ad30f03a-8582-560b-bb63-ae6e46f85c12", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1bca1773-2215-546e-a320-16812b46a409", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e2b9d526-8b2e-5791-b03e-dd4b041fcdc3", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:18d2487a-1fe2-55b0-b8a6-115ef6310f50", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e8eb6c8c-2538-5e38-abb7-4cf5c1d85b39", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:161b067b-a58d-5a50-87a8-f287a0772f49", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2704b82c-7a39-54af-a014-c587ff129119", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-webmvc 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c19249ed-63ff-5ddc-ba7f-46d8b544e9dc", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:778fa70f-a40e-51b6-a942-6d14f9444ab1", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:591ee400-024d-58e9-8f59-5173746d4fff", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7eda2aa7-9747-5617-87c5-88dd1b0b9f7f", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6756e674-d0d0-5317-b0c9-8c5a78cd42d2", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee0bcd32-d30e-527b-a743-a5e58ed63f13", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e06ab29b-d8a3-51b7-b63a-cb6ea4e99547", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:49e0c597-f45f-5809-b9b0-698f85b9396d", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ca16e13-7b28-5887-a01f-62f4e79b6078", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5642bc11-7168-53b0-93dd-d0ffb57ce426", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:61ec8d0a-b0ce-5a7f-9cef-8276f980ce8f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:71336e7c-d0af-5000-9de0-179fdfffa54f", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b76d2e5b-2b51-55e7-8932-6d9085a0c2f6", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3181135c-d59d-56e2-9921-6c030421305b", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f661f8b6-1340-56d7-821f-46c98d59c6ed", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d68b76e8-4340-5b2f-a4aa-dbb92949056a", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:43d68f6c-f9ac-5f8b-9922-b3a1fc3381cf", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b094433b-ed89-5bb9-ad3d-d5c2dda9c944", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9800ed4a-9c07-5a06-9ea7-72bb392ea1cf", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fcf85f17-9eb2-5d3b-90e5-3bb6dcb786a9", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6db0c6fa-55e0-5724-9790-4b8a259bde6e", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d8eccaf0-733d-5069-a84a-4ced75fb0077", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4d1d85eb-c1cd-5761-bec4-aced3ba9fb08", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f8fd31a5-bb4d-5a38-a387-3f0ef311b071", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c04b9c40-1f41-5410-adea-a0275049cfa7", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5468cd17-3acc-51ec-b756-5f960b11ddc4", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.20.RELEASE-tuxcare.3" } ] }