{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e89e4cc-ebaa-5a7a-81b6-cf56cfcb7603", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4a53b535-3949-58c1-a6a1-50992a8ad593", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:948166f2-2b0d-5ed1-ada7-72fb1c8aaf93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d5d9013e-4ced-5bf5-bbba-5dbb5df735bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:83438a6b-5282-5e3b-9b23-68cda6727960", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:56a197a3-e782-5ea6-9bd4-fdfee791bf58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e425a32f-622d-500f-910d-85d7ad21c90e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:eb82cf38-e720-5f40-90e3-efdd7c847025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:aa159b35-83d0-5821-b717-a6b7a4c6565f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:30aa8fd8-beee-5d2c-a6d9-9edb7ae273d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0006171e-19bf-565a-8503-040e3eb081a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-beans. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:29040ad2-33d0-5cc6-9dad-a1c6a8f9bbcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2a0baaa8-bce9-51f9-b52d-eac99cb28c91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:436295de-f76c-58bc-b6fe-49db958cac1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a8a83173-c33f-5078-9fa4-6b2027fafaec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e6a9e0fa-bb9a-52cd-b75e-11d32d61fe06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:deeb47ed-b167-53b8-ba0b-f89a5ed0c10a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5e7cf848-fb2c-5535-bb4e-dfc4be96e567", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-beans. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d6afc026-e28b-5524-a0d0-a98074fecc0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-beans. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e816af36-2ac7-53c3-b1dd-b53d16266765", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3cb2236e-c41c-598c-81d5-61065d6a2029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:da7dab98-cc2b-552e-b09a-dadfafaa6599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0326906e-9e2a-50e4-9e6a-7f7f696431c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ] }