{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:97144936-a4cc-5fae-982f-fd083e2e1ee5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:75dabc2e-f86e-504c-a94a-00c7ae3d7005", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:29376649-814e-5a56-8811-c075377ef9f9", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ff9361cc-f218-570a-a5ee-170bf28c3343", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a6ab5141-327f-5728-8dab-736e030a6830", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2bfe5487-ddb6-5de2-aad1-306d48b48c9d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9d2253ae-88d9-5f8f-b75d-29915a478cf6", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6cce61b8-14c1-5600-82e6-8e6deef0e17a", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c92c7713-79e3-5aed-9338-3ed5a78eba80", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3433a69d-54c5-5f0d-8db4-b5ca1d562136", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1bf4669d-aa1f-5ed8-ae4c-8c8d83055123", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:21e58466-2622-5eee-a705-4e5b45291ba8", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:94a56e91-1bd8-5f3b-9530-5b05562c5abb", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fc821b96-144d-5bd1-8b7d-1c5a7dbf9cd7", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c4ddec4-fd4c-5c3d-b334-7973111e90ba", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:735507ce-aed3-58ad-b0c0-78e33a20a6ed", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9cc7ae0c-cbd6-5e7d-afc2-bc8c83d2c80b", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1030a261-4899-5adb-b0f0-e96a9166b1c7", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:377d390c-c81c-5c8f-b1f4-1e1292c6bcb8", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5fd177f3-c6ab-52d1-9c08-7bc919b0ac1f", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0d584ca1-b8d6-5e6a-8017-d498de205540", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2ab9e61a-bd2a-52f8-a889-ecac9a52cd9e", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1323ae72-3c31-54ff-b5b9-279717b8617f", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1124aacc-d733-5c28-b8e8-6253e6b14a28", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b99451be-0f66-5c13-9a93-aa5f56a2a19c", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a1fe97d7-162f-5fc7-a532-c2b3efa76a81", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c388536b-3784-526b-8689-274aded3f3a8", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:15aadfdb-5ccc-525c-8f71-5a98b091d188", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d4d0c86e-d058-5970-a85e-6719ecbb808c", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4309c509-5924-54b4-b28a-d152a5093b9b", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fd511d17-7878-5b57-8e4d-3705797dfbf0", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7c2f5800-f2f8-587e-be21-23a1042d0a66", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7c670fa4-9030-5d5d-846f-db4ffa50e7bc", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dcd8e783-31ef-5312-9713-3c8d2fc790e9", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:20fa1f55-689c-580b-b879-26a916245b3e", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c9515c17-6bc2-5a14-8fc8-23cb1764c5c0", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3deccbe2-ccf1-5648-8f76-f0f85fb6fab6", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f9b83b29-ff1f-507f-bec8-6812ac005611", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:23170bbb-0807-519f-9c60-f4a91c199d5f", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b0af2881-7282-5489-92b4-f38af97b3bf9", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4da02a50-355b-5791-8d83-3be0e11003e5", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:690540ad-62b8-54d0-9ac9-6ff003b64359", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8d141bb1-8cf9-5007-b092-5f7cac90cbe7", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:518868a9-5c91-571c-9dd0-c141b252a94e", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.5" } ] }