{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a20b8949-1407-57ad-9b40-12a13a35ade8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-data-couchbase", "version": "3.3.13-tuxcare.15", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f8137c64-9568-5e80-82fb-c9debe0af83b", "id": "CVE-2025-22235", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22235 does not affect version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase. This CVE was fixed in version 3.3.11 (https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-9804539, https://github.com/advisories/GHSA-rc42-6c7j-7h5r) so version 3.3.13 is not affected" }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:5e789fed-9e58-5724-aea2-38a2f6a48ea6", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:2b2a60a4-3b2d-51d0-880e-c302e683705a", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:20193ef7-3b3a-5f44-901e-9b149a201a15", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:3d57f0a1-3146-5276-8a66-b20f63a08983", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ec471014-dc87-52ef-94e6-09bbc48c1eff", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:85698d2d-9533-5113-b5aa-7b3e919654af", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:cb7fe36c-c4b3-5143-bcae-3c53bb4a6b05", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase. CVE-2026-40992 affects only Spring Boot >= 3.4.0 (ranges 3.4.0-3.4.16, 3.5.0-3.5.14, 4.0.0-4.0.6 per spring.io/security/cve-2026-40992). The vulnerable code path is the mail SSL auto-configuration (spring.mail.ssl.*), which sets an SSL socket factory without mail..ssl.checkserveridentity. That feature was introduced in Spring Boot 3.4.0. 3.3.13 predates it: MailProperties has no Ssl class and the mail autoconfigure package has zero SSL/socketFactory/checkserveridentity references." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ca862ed4-2d8e-5ca8-987d-1b1f7e7c7058", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:edd3b000-5469-525a-a670-78b9e5ee898c", "id": "CVE-2026-41695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41695 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ac163a78-6562-5f18-9307-6abb5d9d4ee1", "id": "CVE-2026-41711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41711 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:36194f81-77b6-5a19-b044-c74efc5a8dd4", "id": "CVE-2026-41721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41721 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-data-couchbase." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-couchbase@3.3.13-tuxcare.15" } ] }