{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c46b2210-bd10-5a31-8633-8e452edbce68", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-webmvc", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f96c3837-f292-575b-a90d-24fedf3cf559", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:887087b0-aae6-5c8f-a6bd-9febcd6a95a4", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b739a887-1428-5f49-8527-e88ffb20a5e1", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:265a3fc8-3bc0-558b-a58e-00db9022117f", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5646291d-3f49-5c65-9d59-3fd3eeaa33aa", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5ce1bc23-d3ce-5c33-b45a-915f32d83476", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e935d41-19a6-5bf9-9b29-5cf67123e080", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:47fd1818-e0f5-53fd-a54a-1eced9291704", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b839a3df-2a3d-5302-a35c-90b6365d29cb", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a96cbb03-401c-583e-af13-9a727208eb08", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6e9e58da-0888-56ef-abbd-e5373d6b0d10", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:91121d34-47d7-56fd-b281-c8fd394522c0", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0bf73ea5-57bf-54d3-a0e6-3eba7936ef6d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2cbc3e2d-9667-5416-a2b3-1e67d06d0682", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:914925ac-20eb-51b8-9c37-4cbb896acb85", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8bc2da74-ebe7-5898-9f5d-2cbf2b000982", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef9c15f7-50c1-58eb-9216-1c26b8a22236", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:97b1b957-b513-5804-8189-2997b8739cb0", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:787d154c-baf8-5ce9-af71-33880690e01d", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:94c3cf78-9384-5b14-b54f-c50090145a88", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fb49f2a4-0420-5ab5-a0cb-a821c7eeac32", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5232015f-f6a9-5c43-a7dc-e5ead7cc4e9b", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:34a20914-a29d-593d-b4fc-d2509d11311f", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:05940715-6446-5024-9107-504bef68cfb1", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4aa25bb3-6945-5e8c-8f5b-5dce68bbd46c", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:78040fe8-ab38-5a92-84c5-429badcb438a", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:073112bf-d942-5a50-8f91-ea62621a7ce6", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:72b623cf-5848-5926-aa74-720d406cf49f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3a2d285a-3661-5094-b780-c15664be9973", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9e170183-00a4-57ea-899c-461154f6583f", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:622d8abe-809c-5e99-a59a-c09f3b92f564", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4107d927-f712-5586-9b4f-7915933c0892", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bd474cb6-55bc-5feb-9edf-c0cf54222613", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:717464f2-e710-5333-acf4-0ccbfd4b3631", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9eddc5a7-09b0-5b45-a935-d52ceb462ec4", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3d219a5a-6412-5601-812c-682cf21e29f1", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:901400a8-5bd0-5f33-9888-954bf064f1af", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dec0c3ec-793a-5921-be74-00ccb4ba77d4", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:20f0c932-6d92-57c8-97eb-7845f5dd6367", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:677be06f-b41e-5150-a64e-7b252d4fbfb2", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c30b1555-2557-52b5-aaf1-9a01d7edfe07", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:500d6e52-1812-5143-8af0-2363f951ce7c", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7192d9b6-b6bd-5b0b-a2d6-99b812c9a4ba", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.6" } ] }