{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:670b6ee9-4b0b-5053-9dc4-14309285e096", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:22726a40-d63f-5659-a2d5-56a7481d8160", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-beans. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d986597b-363e-5cca-844e-9bcbbc743628", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2eec48a9-29fe-5864-a7db-70c9e8a4a70d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a8558d78-59ed-5da4-9e6c-e30899cce347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2809e72a-28c7-5162-b4de-a075a2608684", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bec44fef-3d1f-586f-b878-f0a1f4c3a6bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c6028621-7e75-5141-b572-e83a755df84f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4d58de12-a760-5665-9f55-a13a15c92b61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:03e63417-d345-5050-833d-0b3bd9c1b776", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7db6e62a-036c-5b93-bd2d-5489d1051275", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-beans. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8d6c38cf-e889-5be2-8f54-b3aa846fd2ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:72a33fec-e19f-54d7-ae4c-e25eaa9a7e8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b53f155a-2368-5aa1-b3e0-dd3d3df584d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0da2947a-e163-5f38-8630-fd1a02019039", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9ad68e53-317d-55af-8ccb-8de37df4f7d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f7de8a73-eec8-5573-9f24-956e9c95fb42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:afd7f151-f11b-5470-8bbe-4b7fc2515be0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-beans. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f9232396-f491-5fb8-b287-fcea7e911bed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-beans. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c87bd152-25ef-5086-8390-69a10bd0aabf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e674a9ed-4137-5a50-9f44-bb5bf8c691a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e9e11c4e-7472-50f6-9001-568b76007bce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:89be7b08-4545-520c-a22c-2ca854d3aeb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ] }