{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ce8ef5b6-9ffc-527f-b72d-a25f3dc9db9a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4", "version": "3.1.1.RELEASE-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "3.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:b9916ce3-a5a2-5955-8036-c5c1bf545657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:3202100b-497e-5759-9b90-723b49c16e81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:7997f978-192a-50d0-afc5-525e7188cbd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ca648fc6-7ebc-5c50-8239-2ef3062e57b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3578 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:63588605-ef26-56b1-ae6a-ae7b57b05cc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:bdcbabe6-5ca1-50da-b762-80a7e9845e7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:3ddfdc0e-fe24-53ad-816b-ccf6ec8360a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:2d944c00-c4a7-503b-93f4-f7e049bcfdf7", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-11040 is a false positive for org.springframework:spring-beans 3.1.1.RELEASE-tuxcare.4. direct vulnerability is in Spring Framework project - affected versions are 4.3.0-4.3.17 and 5.0.0-5.0.6, version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:e9a90bb8-297d-5a8e-969c-729014da92ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:403d993d-b1f4-54a8-a466-949b3cb8a747", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-1257 is a false positive for org.springframework:spring-beans 3.1.1.RELEASE-tuxcare.4. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.16 and 5.0.0-5.0.5 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:eaeb2202-8618-57b3-8e07-6b364abc5798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:e6a79b26-f5d0-5217-a416-87b3f9738aac", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-1270 is a false positive for org.springframework:spring-beans 3.1.1.RELEASE-tuxcare.4. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.15 and 5.0.0-5.0.4 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:69183a5e-c2b7-5e78-850e-10dd4b4fce84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ffcdb440-eded-5c15-a740-dd4459937096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:a3c36f81-5d9b-5191-bdaa-fe2d66d6366a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:b630a2c3-2858-52d2-bc81-f0e3cac7e2c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5421. The target version lacks the vulnerable code pattern (removeJsessionid() method) that existed in Spring 5.x versions. The existing RFD protection (from CVE-2015-5211 fix, commit 4a08cd41d9) correctly validates jsessionid path parameters and blocks dangerous file extensions at runtime. TuxCare backported CVE-2020-5421 to Spring 5.x...", "justification": "protected_at_runtime" } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:2747a928-8ded-5e9b-8ce1-e34d27a345b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:0575ba12-60c7-5219-9d51-5d8f8e557430", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:1a438bfb-3802-5b15-bb25-2e2111f492fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:b74e464e-63c2-5064-b52e-a529398454cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:f030f38d-2244-5ff3-8fc4-24b76dd1ac06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:0091b1c6-3e34-5f5b-88ac-85d0ea6291f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:a7099ab6-323e-5fca-8fa8-dc14c799668f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:5167dd9b-acaa-53d7-b98f-a89d6ef01f0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 3.1.1.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 3.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:7cde55b1-f38a-57fd-9b8b-86b611f7aed3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:3611c553-c979-514e-9409-368d88b5d5ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@3.1.1.RELEASE-tuxcare.4" } ] }