{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:139f695c-a6e2-5c52-96a6-90d1c82fb40a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.2.13.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8d082544-6c79-55bc-a7b5-cb59f0f2c5bf", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e3e1e532-6075-55b2-a044-7dbf96f085b5", "id": "CVE-2021-22060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:043c6b46-a7b2-5890-a27d-02e9b0d6b9f6", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:338184c5-0c2d-5553-a18f-0a684d12a233", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6d1df70b-7a5d-5b1d-a2ad-7003c9b83349", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:24744617-789c-5c7a-956e-946b662c41fa", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:516c6b8d-693a-57e9-823c-9abf13dbcd0d", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:307a2743-cd57-5e38-bf2c-724602ac42de", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eb79059d-d47e-5980-b6c7-122a785c320f", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6264a2bb-89c5-5b9e-a9a8-ad19653badd9", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0b14223-2d80-5cbc-8189-fb7496c6708d", "id": "CVE-2023-20863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f2e25a96-b152-5b5a-ad5d-5124ad2b19ba", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7f9a8a98-f90a-568d-800f-0c7dcb24a767", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9131a806-2dfb-59d9-830f-99d607f91565", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:726f6c69-7941-5055-a462-ed4cf8be0d04", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:29a835e3-8e6b-5b3c-ba15-530bba08a02d", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ad5888bc-7a2f-5d82-8057-792f68eed591", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:858c954d-388b-5288-a65d-4770441db0d7", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5dfa5458-94e2-56c4-8542-57c036287180", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7a9dabc6-2b8d-5d02-bf93-8060dcf89547", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:52f670a9-d1b5-5dc7-93fe-9a09f1335adf", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:45f20638-e6f8-53e2-82f0-3b0f584e7000", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:14b6e8a3-9a04-52f6-a5a1-f967d916cd9a", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:db7c7ebf-d368-5b5d-bc6e-975fed86cd4d", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:63ca3075-0e67-51f1-a648-78370570226e", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ca4cc2d2-cf2f-55ca-b28d-519a9a3713e5", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5576f933-5063-5f4b-afcd-2c28058d6702", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:46e02e4e-a9e3-5922-bef4-520aeb2b4444", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:05d883c6-f108-517a-9e43-0f98095e74cf", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fff3890d-1fe4-5f0c-8eec-fcbf41e53e95", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:714c61e7-6081-58c6-b85f-ef1c0d37a191", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bf602c0f-46ae-5d76-820a-83385b333c39", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aa7e5e85-2544-5680-8a84-64de1ec0106b", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f3dddd4-9b70-50e3-af4f-fcc190c7fb18", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:50e5f188-ff79-54f5-9742-568683c32df2", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eab27241-f41d-5fc6-a9b1-02528d8dd4d8", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bdadbaea-b798-5e35-8115-9e07dc0c5ff8", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4928a612-6a2a-5166-80b9-d42d59e62db8", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5b898443-aca8-54e0-ae1a-55d86afa420b", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:37592f1d-e67a-505f-95f0-b2875dac8734", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8e40a5a9-61cb-55d2-bf01-23f3eb67f273", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fda1f2ed-9fd4-5cbe-b777-a75717a2c0dc", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c809924d-4c68-52fd-b3d7-695757604b2d", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.13.RELEASE-tuxcare.3" } ] }