{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8477b371-7fd5-58a6-aa1b-f07d60e579dd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12", "version": "3.0.5.RELEASE-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE", "type": "library", "group": "org.springframework", "version": "3.0.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a116bd3d-e1f2-5c35-ba0e-c6512b051e39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans. not_affected \u2014 The target Spring Framework 3.0.5.RELEASE is not affected by CVE-2009-1190. The vulnerability involved an algorithmic complexity attack where malicious serialized data containing regex patterns with multiple optional groups would trigger Pattern.compile() during deserialization, causing CPU exhaustion. The upstream fix (commit 9306d6dbaa, April 2009) removed this attack vector by serializing th...", "justification": "code_not_present" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8f2cea1c-95b2-5edd-a8bd-aa84cb1b3827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2011-2730 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:69d69d51-3a8a-512d-b36b-742ebf4c1a10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2011-2894 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0cab237e-30f4-56bd-8d71-615ca2d8e29b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3578 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c0886db0-b6e2-5883-a0a1-5720f8b7f37c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6de19dc1-067f-559e-b208-d2de22f1bb08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:ed0c5cf8-bd1e-5629-afc5-4711d53e4b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a58b9a6b-85ce-5071-bbe3-39c126b0e7b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11040 does not affect version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 3.0.5.RELEASE.", "justification": "code_not_present" } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5db0a343-bf67-5859-91b2-48178a3c85c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:09bdbb6e-0912-5ded-9818-16f88e48e777", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the spring-messaging module, which was introduced in Spring Framework 4.0 (released December 2013). The vulnerable classes DefaultSubscriptionRegistry and SimpleBrokerMessageHandler, along with STOMP over WebSocket functionality, do not exist in this version. CVE-2018-1257 specifically affects the spring-messaging module's handling of STOMP subscr...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:211c91cb-644a-502e-9c1e-391e13c1f91c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9a109d71-7a8f-5192-81e2-d109de7abde9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1270 does not affect version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans. Spring Framework 3.0.5.RELEASE is not affected by CVE-2018-1270. The vulnerability requires the spring-messaging module with STOMP over WebSocket support, which was introduced in Spring Framework 4.0 (December 2013). Spring Framework 3.0.5 (released December 2010) predates this feature and does not contain the vulnerable component (DefaultSubscriptionRegistry) or any STOMP/WebSocket infrastructure. The attack vector\u2014STOMP messages with malicious SpEL expressions in selector headers\u2014cannot be received by this version.", "justification": "code_not_present" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:662a2d89-6cf6-5c4b-b621-82288ca0f6c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:f120f812-e744-5d9e-8ddf-78577984f35c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d08034e3-e5b4-59fe-bdb6-91d1888fedb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:758f426d-e137-5ede-9d4e-e7caca5a1c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d5a7fec9-254e-55a3-b02d-d81ec019e1c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:63c94d27-ed54-545d-94ac-61833abc0057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:90618b46-dd37-5299-bc63-4d55f1ec0346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b3d14069-1311-53e0-9e51-e29030cf547c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:340ee572-b8e0-5337-a154-53f40aa6851e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c821054a-7336-5079-99c7-2b7125aa5701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b13f45e7-84ad-5c93-b6d6-0f0eadbc29a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:1d16c2c6-4dab-5478-a719-3c62c2f3e935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:cd95367b-4054-5234-920e-1d206efa4cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.0.5.RELEASE-tuxcare.12" } ] }