{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8f57a42e-579e-5fd8-b1bc-89be23accb94", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ed52e842-f63e-5bdd-a91f-6a94516d3cb6", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e081bf5a-f236-546c-a306-0791ec7059df", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c9c587a0-ce33-5062-82a8-bfd642b73f14", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0998d4bb-946f-5e24-a46a-19becffe907f", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:59a26780-e9fa-5399-a029-5f1417b96630", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:92ecc174-92a6-579a-869d-688533782e38", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e7036dce-c287-5323-b62b-90f03467bfe0", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2632cc81-250f-5fc5-942e-b2523555bb87", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:492afa8d-6958-540c-b33a-7871ff37e2a2", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:90d78849-1010-50cf-a903-f300fe5dd613", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f8683c69-3ee8-5111-aa37-e42b2c4e7fa2", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b30bbfdb-344a-5ee9-9090-83e2c3310cf4", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4485e42e-be21-5988-bb99-1d539ba694b3", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e1bdf3d3-aca6-551c-9ae3-6599299f32d5", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a069830e-e9fa-55a7-9e6e-f49bc1a5ede9", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f72e718d-c1a1-5fd6-9e32-851b3fa615d8", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:150782d8-cdef-5e97-8672-f4b8e26cf2cf", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bb19e99a-ef29-5f7b-be4e-9221250be075", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e55d5197-51f2-5456-bc57-e7cbbed14311", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1c9aca8-c521-541a-b23c-2ef540888286", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3ea7b745-418d-5122-9cba-f7599ecdb682", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:62f1bb01-f58d-5497-b07b-489ef282903b", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:96b6aa54-8001-5024-929e-5d1737c71792", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:174dd491-426c-5930-8080-ca900d91a7b6", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:92432e0e-3d99-5056-9853-c5cb3ddccb54", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:efcb2d6c-2cba-5004-8a0b-5ead1329088e", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:90f35db0-5c01-5c5b-bae8-25b924c9ec44", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7ef3315f-7d28-5614-a86f-5b7224afbabf", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e43a0dcb-aa73-5889-911c-fcad76b5fd95", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d3c64821-41e0-52a5-85f5-800053ba6721", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:836548a4-8a67-5935-a2a6-8632427bf23e", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8a6664de-a384-5ca0-8620-abd4d60da43a", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2aa7e312-2c45-5b41-86a4-3409b035cde9", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:560a7d76-5e65-59c9-9d0c-b14c61edfc55", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:96bfa092-c7f8-5f21-82f3-7d78b3e3cf7d", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0cbaaa26-c9f8-575a-a4bb-5c8bef3f6101", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:50ce447a-5313-5a2e-80fe-8777783e1b4f", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de674012-569a-52af-a04d-69ac04813c2f", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1818d157-ef5c-5a29-9d05-e8e42f6afdc3", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de3afd11-5a6e-512a-b91d-ac7a533c4fe9", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6bec2155-805c-5567-84bf-31a3fd1a86c6", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:21275a3b-f00d-5cd3-9d4b-1384dda381ba", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ed61fc96-e6fa-5448-a794-e3d1c1855522", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.2.13.RELEASE-tuxcare.6" } ] }