{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bcb6cd47-90b3-5a5d-9545-9a1038070eb8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-webmvc", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:81c3c1ba-ec52-5ae7-a112-e3cda380c44f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8fd877b2-f98a-5932-a3d7-d77543bf318f", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8941b3c8-7f86-5a7f-93de-590f09287521", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:802af4f1-f415-5246-9f12-b76a781336c5", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:66474097-bbb7-5af5-8dee-33d064027e9a", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:100df07d-b0c5-5840-8edd-54704950035e", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3cbcfb8a-0371-587f-9873-1dd41a46a50e", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ffddeb49-2697-5035-91f6-3945f41c3d41", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ee9869b2-1c6f-5604-8b3e-c576b6f4bbfe", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d9efecdd-8605-5e5f-8e67-7c82b416d21c", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:57b83498-e204-5cf3-abc6-ee1a270b42c1", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:66c3df6b-3653-5b05-ac01-2e750ed707e5", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2789b132-ac65-5d13-a31a-66331453b040", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7ae40b43-76c0-5e6a-b405-1b665423925c", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1271e6b2-f489-5ab5-aa18-f4cacf16e3ed", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2afbd135-16d5-5fee-83e4-bd244a5c0ac9", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ad238939-3460-57aa-8c9c-1d056146f5cf", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c7eb433b-fbca-56b2-8578-947d5c7767d4", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cab9794c-76e1-5f6c-a5f4-9592ba8a28f1", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b79e085-16c6-5381-81d8-4d3f5639713a", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e615c3b0-9076-5966-be1f-554b0d790952", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9c69453a-f965-59db-a15a-2ecc04cc233b", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3e21dcfa-f0a4-5ba0-abfd-9a9106fd1cb0", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:539e4717-c5b1-5013-9118-c1e9b700b364", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5e01dd65-ea74-5751-ae24-c0cad30c01af", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4a129a07-3060-5560-b546-c73b6febb82c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dcc3b49e-e241-55cf-9410-f6bbf01c02e1", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e594683e-a4d3-5b26-be3b-0be3c732e48b", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b4c04846-9244-515b-bc4c-c8ed49ae472e", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2b25e100-73c8-5c87-9e4d-89e607eb5c88", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ca965e81-b3bc-5bff-a498-501cf2e818df", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:224ff03b-57bf-5716-92da-62bd8d941117", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:27fc2122-edf3-52a4-a4a4-f3e0f8096e5b", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:54f008d6-273d-5502-9c91-0169fb3da803", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43fccad9-6736-5833-a4e6-3b86a2007201", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c782bf81-0a90-5045-b465-06046f9b4a30", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:56f9764b-9fb6-5c27-a07c-42825912926a", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5062bee1-dadd-5ad7-a95c-fba885f6a1ee", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5d39441f-456d-594a-91e9-ebf098eee31e", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2c1f1075-5114-53db-a868-fc22d0890f64", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0cf21947-cd6a-52f5-8f50-6f594601d3a5", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aea597b3-ab5e-592d-bdae-f3489bcdffed", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:80e080bd-7d5e-5bc8-ba9e-d2be0e3f4325", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.5" } ] }