{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72ce55c6-8e4d-5519-9336-06e0b1310ae4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.0.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f5e6d49b-cd5c-5dfd-878b-1aeb71fcc9fc", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:333e8ca3-a53c-5834-a76a-1b90e784e0ad", "id": "CVE-2020-5398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f0de112-5b52-55a7-88a2-06c7da8fac87", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ffb27613-dd53-5ba9-bb21-b5bb1089eb28", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c98d5dfd-7799-5687-a71d-1f98490cc983", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5a904429-46e9-5948-8754-027937ddaeae", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f0536afa-fead-5587-8f58-cca2f3b1b86c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:94f66960-a606-57c0-883b-705b2c3235de", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90c6eb34-324a-57fe-99fd-d09eb05c229a", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f1b1569-a260-5460-89cd-5e29d4d94678", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3e020168-2df9-5fa6-85a9-0aa218affaa0", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:71e38f19-48d2-5878-b918-8cbd1e0bdcfe", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c13c912b-6c26-5307-afca-198690761bec", "id": "CVE-2024-22243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:87c37b61-910d-5b61-abcf-e0ae9b084c21", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:546d9524-e34c-58f7-aa0c-4e95278748f0", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:301176e6-2dfc-530e-8657-89c1d4b6ae27", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:04d77a0a-0ec2-5df3-b5f7-42c698c015d4", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3938f728-d3a0-5e6d-a660-472ad2765166", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69657e17-ba84-5583-9393-315576a90691", "id": "CVE-2024-38820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:63552911-5f1b-5b26-965f-b26c7e36d529", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:87fd799f-79a6-5f83-a021-e4cbbecb9171", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:166059fa-ed52-5baf-9f56-0fe8814c6d5e", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8713919c-d651-59e9-98e7-ceb9b7d85022", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:53ceabc1-0c74-5548-ad52-e34e9107d2e9", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d3591340-7a51-58ee-9358-51cfa405acae", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:73e67145-08bc-5c57-8fc5-f0a7311218c2", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1ceac0b-08c7-50e8-ab21-d6b44c0ed8a0", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:44bd7f0e-0acb-5097-857f-afb28614fc3b", "id": "CVE-2026-41840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9d7ab1ea-d50f-520a-9d15-51a75044c8a1", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97cd1f61-8019-5ffc-940b-71e5eabce84e", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f3e1743f-b03a-59bc-aa8e-39779e2600d2", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:61377536-dac9-5fb5-b550-f1d2cebba454", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:edccd3ff-8fd9-53c6-b7ba-d7b0cd2a79e7", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d98a9ec-efea-5a2e-829d-e1fdcd280cb6", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:059f1c28-7bb2-57c2-8f8f-063260a80cbd", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:32a58909-4644-535d-a1f3-65c52fe162a0", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.0.13.RELEASE-tuxcare.1" } ] }