{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2647aa83-ce98-5768-addd-76f1a68eb662", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-webmvc", "version": "5.0.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:03e28138-decc-5ac8-8344-b9dd5ea91396", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:98fc2242-4fe8-52f0-845f-fef5dfa7f5f4", "id": "CVE-2020-5398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:544e9db5-cb8e-5838-ae4c-677b3b0fa7e0", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5fda376b-a504-5bd1-b96a-838b6a3dea5b", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:10051cfa-4279-5e54-a7a0-b6697357fa14", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:290988a6-9c9b-5857-99f2-1c48b967c7bb", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:379e95ef-74f7-5499-8c8e-95cd501f4d37", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8742542a-f472-5472-b692-c1d5075131e9", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:50523fb1-ca0f-5b62-adf1-44b33755d9b1", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5d16abc7-3375-53bc-8f26-54a4eae923a3", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:20730fe3-1cc2-5360-9c54-95c392054e11", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b10ec70-0ba9-5fee-9786-25f53dfb69b2", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3c60edfb-12a7-528d-beb8-c70f48f59703", "id": "CVE-2024-22243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1e43390-48d5-5217-9914-d27679e81bfe", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ae065ef8-1e72-53f3-b139-eebd2ab50e84", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:30af6b7d-8203-514c-bc43-b3742f691485", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bbf47232-1da6-5695-9120-2a0b6c9c2567", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3db27e49-c8a0-5514-854b-034e52086681", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3fa8f838-bafd-589c-8f2b-0a39721592d8", "id": "CVE-2024-38820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:02f0f29f-ca20-51ab-86a4-a9230045c88e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f6ab11fe-5cd6-5b8b-8d00-9c9ee044f381", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f182405a-4e2d-5115-b6ab-faf3aed7a976", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:831dbafd-551b-520e-8922-ef4a6e034059", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ab8c3c69-27a4-50bd-843e-aca6509c8a83", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0e2649ac-aa74-5603-b8d5-5d4a8b8db1cb", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1c1ab2cd-e628-5d6f-9a46-5f074a83d187", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a8095c7-6436-5187-ab39-bd9f878a56dc", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:35c64d1c-c61d-59c7-a748-ace8ca46bbe9", "id": "CVE-2026-41840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:038ac025-6ab1-5fa6-bee6-ee37447e7ac1", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f946b78a-5fd7-553b-92ba-5f6148ed023e", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:acdd2914-1021-57d1-9a14-d359e28da13c", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:31c24e1e-dd17-54ad-8118-84b161df2437", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:89cdd926-d564-53a2-bce5-8c5273ec80e8", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1d703409-7933-5abc-ba49-68a4240ef588", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6be99180-aa61-599d-aece-fd891c2fe97b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90f3434d-a76e-5f46-870b-4d4846e795dc", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.13.RELEASE-tuxcare.1" } ] }