{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2833a6c1-5511-5388-9097-9ed3a68e82db", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10", "type": "library", "group": "org.springframework.boot", "name": "spring-boot", "version": "2.4.6-tuxcare.10", "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3ff5623a-4530-5718-b594-0b33d716b1f3", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b2ea6cbb-6da4-5a6f-96ac-1bd4b9e217dc", "id": "CVE-2023-20873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:82e63e68-32f1-50b5-856a-b9ac1569fd40", "id": "CVE-2023-20883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:eef71031-50d7-5a27-bb12-7dfd8e067f85", "id": "CVE-2023-34055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1943117a-09fe-5a1b-8b1a-f44192d772e1", "id": "CVE-2023-38286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-38286 affects version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:91473257-da0c-5f5c-ab73-27c48298621a", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5b75e4be-0119-5c4f-8f48-29c60ef17793", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4754716b-8e5a-5e1a-ad72-90ae3c2d45aa", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:549b780b-bbeb-578c-834d-3248d5178ef1", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6a7177a8-a7e3-510c-b132-523775331130", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5878d8cc-2fc5-5a01-88e5-26f435c8a8d4", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1f6c801b-aa58-5c3f-9a27-3c7a9642903d", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4f7dee0c-0f0c-5b07-b910-de1e25fd1db8", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:04e80281-6f72-52a6-8d2d-1e78cbc69723", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot. version is out of affected scope 3.4.0 - 3.4.16, 3.5.0 - 3.5.14, 4.0.0 - 4.0.6; MailProperties has no Ssl class and the mail autoconfigure package has zero ssl references, so the vulnerable mail SSL auto-config code path is not present" }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e68f42f5-696d-5020-a804-0b339165c8ab", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.4.6-tuxcare.10 of org.springframework.boot:spring-boot." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.10" } ] }