{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d2144752-b2c7-5114-ab6d-5e56572a707d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "5.2.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:686544ac-7e1d-56b2-a1e9-cde1e06996bd", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:754c0f88-8bcb-5314-8f38-30ed264bf1e5", "id": "CVE-2021-22060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:75dc1cbc-ef92-53a7-a601-22f5a4f42521", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b4ee5477-4a6d-55cc-a93c-f98d232172de", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ffb3617d-a05f-5faa-bed4-d41670b2da27", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1802d61-4efe-582f-8a9e-d009c5e67d37", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:55c97351-b66c-5463-ac31-58c147de74c2", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6efff51b-dea5-5884-8547-235052327417", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b368ea9-34dc-5383-ae50-976dc8c69215", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fbb874e0-ffea-52bc-8486-8e382c113336", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3ea518d2-3457-5e79-b99f-f2032f789a6b", "id": "CVE-2023-20863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1bba36e6-86c8-5c18-8edc-8ed3fa46ddc1", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c99c740e-99f0-5bb7-b508-eb259b6698f4", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8253f1b-3012-540b-ba97-b36f9c1d63fa", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3bf7d71c-61fc-5979-874b-c2dd034b4191", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f60210d-4039-5546-aaea-b9cd60347294", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c8a3efec-452d-5492-910a-ebe02720d333", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:99acfe68-5912-5d32-b74c-eb9765cd6e42", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ffa8a618-1bee-563a-86a1-f9987ed5f8eb", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a485627-2b27-55a1-a839-0fc136718c8a", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:49d2a0cc-bffd-5d23-8eaa-9236123a3caa", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bef90587-d9ca-5754-8c15-972ef7911cb5", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:873fcb18-508f-53f5-9b01-8fb77e746f10", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4a2506ef-a8cb-5975-a887-1cd6ef4a0ebf", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:852baf38-afd9-5210-a8cc-c40a6dc404b8", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7953a2c6-d6cd-5fb1-9c54-5b66e3a775b9", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d533141-c62d-5476-8a8c-069790f64271", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1dba12d4-3208-55a1-a388-091d4f18297a", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb8a741c-54bd-5cd8-a5fa-d602d800954b", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dd0a75da-a2c3-5be8-9a27-5160771eb2fb", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7637e9e3-704c-5e74-8f98-436dc10794bd", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:99588749-a639-57a0-8281-dfc7fa233580", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f138fe85-7087-5b2f-ac1a-1d0e171f5b9c", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:873b60f3-02a9-58e0-8487-3ed0472680ce", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c034a3f-c5bb-51c1-858a-25bd40a4619a", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3e1f5c3c-ce89-5ce5-a135-5f5fab74f76d", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d7f81b49-cd44-531d-b12b-4d63f9110e50", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6ddb93c3-8bea-5fd6-af3e-82600c39d5cb", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:71c701d4-3683-5c7d-9fa6-d6d41b08cab2", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:640f08f2-cc63-5908-b659-2155879394d9", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a5ef7fbc-fc65-526f-92a5-2e86850ec396", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6c809e2e-c0ef-5d87-80f2-c13252eaee41", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:07b971ac-7cce-5c83-8a28-9dcdf9e07ff7", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.13.RELEASE-tuxcare.1" } ] }