{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:98345cd1-eff9-52f1-ab5a-3ce16d1ba504", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:33b6b85e-2db1-562a-9789-00384df617cd", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4c962ff2-5071-55ed-814e-bd68036b92b9", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:acd36d10-c2f5-5440-9a06-c4fbebdfc971", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:989f4adb-f318-5e33-b691-42d2ad154709", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:64f3436d-8366-5808-8a2f-0496d68828e0", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f924c68-8cfb-54f1-8b1e-b056c08657cd", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9f90272-bbf7-5666-a21a-b62b09354074", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:76792a2c-5ecc-52e5-8d01-6b9eb8ca7ab6", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da217699-41b6-57ef-97a9-a80e6d24f0e0", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e0653732-3d22-5028-913f-d10a35b396fd", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35de0124-82f9-5990-9a0d-f10522651280", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6ef673ef-35c5-5f0d-af59-c9316f10814d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4a02adf-ff95-5c11-8985-4e690e0377b2", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fc8b3194-fd25-5356-b06c-ecf08d026499", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:78a0ea0f-dda0-5291-a9c4-e414f5c093af", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5cc0061f-9842-515c-979c-eb8f73cd9091", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-jcl 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ada58b28-40ce-5e39-a1f7-cb64dbf16eff", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb6cafb9-0b59-5d33-b65e-e0418c0b9d2e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:48ad0ff8-b5eb-59f2-9d46-27231445830b", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:70d5c76e-e265-5cf8-b2d5-608db8ce435e", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1e47baa2-2fa1-5180-964e-25d673d01928", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:62c83b24-e649-5fe2-849e-09169b022ea7", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7a71b5d-d198-502c-8132-e5691a617330", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:90cbe4a3-bb75-5994-85df-3033c731aa82", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b87d72ca-25e0-52ee-9f19-7c306fa2f752", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a79a9498-c539-5562-b421-51de1c2798dd", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f389422a-e29c-5412-b76a-b43a7787b588", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:019310aa-5d2d-5335-a958-567b03b52b13", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f29864b1-564f-528b-bf02-cf2dd96f4359", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6e99dcbf-aeda-52b8-afdf-e1db486494e3", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bca51d7d-df76-51f3-8f8c-b3d5333d1975", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ade15f16-db24-5b27-8270-b055b64f15e5", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd878557-2120-567e-81e2-33fead238fca", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ed4ad2c-f76d-57c7-9ffb-f21144439a31", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4dea090d-8edb-5d00-8555-b2da2ffcae2d", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:23f6dab3-00ff-5c3a-99ca-eafa9a6340a1", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9665a94b-92a3-5112-92f1-2f0d88d48538", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:16640aa5-5abe-57d0-8bda-9279d3e7c7d9", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fc0452a2-5214-5136-a912-0f516e61c089", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9e343ea3-a6da-5b27-ba79-c4d3d6c81baa", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c221bfd4-4fe9-5e7b-8ec9-57259be56f6e", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cb0eda81-e8fe-50c9-a94c-dee00ca4e6e7", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.1.20.RELEASE-tuxcare.3" } ] }