{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e55d2c67-f900-502c-88e4-e54d9d8385db", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-tx", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7e2d8c8b-028c-595b-ac92-165777f09688", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1323ac3e-7bfa-5f30-9f1d-2bf39b45e301", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5a33b96-5ebf-5187-b486-d9a07453b8ac", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bd2d5d12-833a-5326-99c3-6b6ffa157721", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b543904a-9bb2-5d3f-9959-5ef232702ce0", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2bf81102-9354-5d22-9130-7a2fda802af2", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:05f2a503-e32c-5bb1-9031-aff07dd8a3df", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:23ff05d1-77c6-502d-8aff-5b7fb31388f7", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ebda485d-98b6-548b-9cf0-b0d8722114d5", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6f0367ae-6da5-5168-b7bf-e1b2faa38ef2", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:841b0ca2-fa7c-5187-ad99-acc465193f36", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0b72cbd-8d83-5f27-b824-2966fc483699", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7a9084d-d621-5a74-bd94-9e1770479fa8", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:799e1f2d-2d8e-52d5-978f-930c8959d7a8", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e32e3501-7947-5e8b-829d-c68646f0f057", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b2a1fad7-5cdd-529b-988c-1158c985552e", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-tx 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fcf169a6-8899-5c50-8165-519ab74be7f8", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:527522a7-fedc-5996-8698-5827b58faa89", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e74f1dc8-87c1-57b1-bb94-49754cecccff", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9554b5f6-a5a2-5bef-8269-96b006cca61b", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:184b21dc-6835-55a0-bf59-b645489d4836", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6ab2a7fe-9147-56d0-90c3-c6a86cf01757", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:afd09c71-99bd-53c7-ac09-3032f4694e50", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ef011039-660f-502f-9b72-8336066b9fb1", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6a10926b-4321-55a9-951e-19dea45fcb71", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e29486a-f9cb-5b66-9487-530bf9415e6d", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cc9edc1e-6ac2-5a22-a59e-08c0390efcb8", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d09f8cab-fa5c-5a3e-ab3f-28d500a06ab7", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1999d10e-4acf-5727-abe1-55a17ea8710a", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eee20eac-db10-5857-bfa9-bbb6e7f8e1ba", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e7b53b8b-6440-5fbc-9194-be7af95cb7db", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b8dc5cd-40f3-5fbc-a928-74064f5f4914", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d62386e8-fecc-5370-be47-6a7aecf7074a", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:acdd1859-a7c3-5632-a57a-6cda205a7118", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eb108c0a-774b-5dd0-9ba4-a4e8fa56ce20", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:63d5cc14-c8fd-5e2e-94f3-76a8d51228bc", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:df0c202d-29f2-5837-94cd-9b7d7a66b6bb", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f47b251-e0cb-5855-84ca-d493a6d4feba", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2cd9f7de-8d9d-5646-8994-1f019aa16a5a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:06ed9851-222c-5a7c-9eed-4eaae320b553", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:92716891-68ec-5ee1-a86c-6bc89e109fb1", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e23827f0-a371-5594-9f11-519a76ea854b", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.1.20.RELEASE-tuxcare.3" } ] }