{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6ae6cb75-d77d-5941-a381-0d45b6a21082", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "5.0.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:db560dfc-841d-58e6-931b-25fecdd9237d", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2161c2c3-025a-545b-a32d-5cb5ab315b39", "id": "CVE-2020-5398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e88d1896-4069-5f75-a13c-50bb0977c2b9", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b228a0d-2b30-5e7f-8e21-a9bbfa6efd8d", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:601f30f4-6b4a-5730-bd65-1df43df42705", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bab55e00-e94f-55e2-ac8a-c2a25e43e66e", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c361975d-690a-5b5b-bade-440552d37b52", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c53dc27d-413a-536c-aab7-2ebf20032825", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7f6b43b4-a70a-54c2-a7a8-4cb26d12b42c", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:516b5e28-4ca2-5ba4-95f9-131ace4f7c04", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b065f9f-7702-5950-8f55-d9ffb0d60cc1", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:914cbef5-8caa-568a-94b4-25fd41050f97", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e944cbd1-876b-5265-a9af-ed34f32a1e6c", "id": "CVE-2024-22243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:da2b25b2-53e6-5d3c-a780-fb6ebb3b8335", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1359cdb7-80ca-5202-9471-f27693406a7d", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fe5a7388-c565-5d1b-9d52-5754a67178e3", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3a5e0259-8394-55e8-bbbd-35152fa2fc81", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:950c4c15-c504-559f-b3a0-6d6684d36140", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fe5cb0d2-06a0-5369-8e11-e2d630a0d27c", "id": "CVE-2024-38820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:94b4c090-e111-540b-b769-0638b6c036ac", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8e52de20-b64c-567e-9070-dc0e8756d721", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:902d0460-b663-5ec3-86a7-0a69c3ae317a", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4ae7941e-a31f-5595-9273-90974afb5838", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:66c3d97b-b87f-562b-8c3b-ae6f93684252", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e4759fd5-d8e1-5fd8-a1f5-4397f6793ca8", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4145490e-bb72-5076-bb0c-33ffa64762d2", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:859ad926-79f1-59ca-8b91-3f04161a25d0", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6ec41274-4144-5dd1-bd69-ccd1267f04a4", "id": "CVE-2026-41840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:457e9e9e-0dff-5220-a2d3-725e9e68c705", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:403278d8-398c-5b17-993d-2c700d59f2bd", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:64e86db4-8af6-5e3f-bed0-74eaa8d1ee96", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:95736e0c-8663-5680-bb41-d920f5f67d12", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:22830fd1-6aa7-5621-b3d0-d59b602ef49d", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:908497f3-3456-5e87-986b-727a3c503abb", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5188f342-ac00-544c-a2a2-02346d9d42cf", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aece5a9b-e8c4-5bfb-bd0e-81e68deff137", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.0.13.RELEASE-tuxcare.1" } ] }