{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bed2735d-e1fc-5bf4-aa1a-29ae89394659", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12", "version": "4.2.9.RELEASE-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:223fe118-cb69-523f-8256-5cc822dd3028", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 4.2.9.RELEASE is not affected by CVE-2009-1190. While the framework still contains deserialization code (HttpInvokerServiceExporter) with no Spring-level filtering for Pattern objects, the vulnerability requires JDK < 1.6 to exploit. Spring 4.2.9 is compiled with Java 6 bytecode compatibility (sourceCompatibility = 1.6) and cannot run on Java 5 or earlier. The JDK 6+ runtime in...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:4c4fb856-04a4-5c94-b3cc-cee54d7a4d1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:35ac967c-a065-559e-baa8-ffe9fb4dab06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:867a195b-bd84-5e46-b44b-ebd2eaea0940", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:60c6f8fa-2615-54a5-907c-e6411951441d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:820d4314-e7ec-50fb-a72f-b404f66580b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:2ae0f395-05fb-5e6d-8874-fba90c35225b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:944bbebc-ca47-5c99-b939-03ee961a0a04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e1ef00c8-fc3e-5f07-8d54-2f04859e02a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c2ee0de1-8b76-5bc2-ab60-7709ab5176a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e547ed09-a14f-5e23-a142-3038defe4fbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:71923707-ec48-5635-bda6-602a4f598093", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:dae3d486-8f71-5449-9dd4-7acc192eae66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d282e477-0d97-5c02-bb52-c8fbe7b3109a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:f1cc612c-7c87-5f49-af3b-44f967315c79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9a9e8199-e5da-5d83-982e-e6cde2e33a34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans, and is fixed in 4.2.9.RELEASE-tuxcare.13." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:74253ec1-2911-5c16-b335-8a0877716fbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6a3a6be2-f3ea-5f97-b556-ac6fa20f074b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7c76b9dd-f79a-501e-bfd8-1d0e7de014e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9fdd162e-4705-5934-9539-3650dac90ac8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8e180a25-9b94-57d1-ab57-ce5ac1065f16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d22eb2e8-40e9-506c-a070-d91bd5403d5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:845fba2a-9389-5227-ab8b-b3ebebebff43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.12" } ] }