{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0758edcf-a50a-57df-beb5-bb38bf58f200", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d20e5f9d-3ca1-5ace-9e20-9aab8484c447", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2009-1190. While the code pattern (serializable JdkRegexpMethodPointcut calling Pattern.compile without validation) exists in the codebase, the underlying JDK vulnerability (algorithmic complexity in Pattern.compile) was fixed by Oracle/Sun in JDK 1.6. Spring Framework 6.0.23 requires JDK 17 as its minimum runtime, making it impossible to deploy on...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:605b33d9-204b-5d1c-9b7e-569aaddbd904", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:75922b93-73af-56ff-9780-41235c80a133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6eade57f-94ba-5d85-abf3-c2507863851c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:26b2cd4f-36c8-5a75-8ce6-9f917a6f8dc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c1c3b63a-d5d8-541c-9532-a638e05c7c89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a2118024-b0ce-5320-9d5e-88b7c63cf1ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3bc2f449-3a43-55f1-afb5-fac71985e5a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e202698d-439b-5b8c-846b-eb9f4bbacc04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d76f0f7c-b075-5870-b2d1-518da681b018", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-beans. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:46c38d70-e971-5e2a-9536-33109a23d3d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:575b441a-49ed-580c-8553-290ce9d6fcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a890ebfc-919d-5f91-972c-1492afa6175e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7a24ee91-543d-5f68-ac1a-b9033ee4d576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:256b7110-a092-5847-b7f6-d74e65fa687f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e02590f8-93ce-592c-bb79-df5a795e7bcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1ca9c651-f7e9-5188-8677-db0693aca93f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-beans. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d23566f8-6156-500a-bf38-5c17ec604031", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-beans. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d4c6f73c-84b4-58a9-8829-9cea43c2e5c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d9cc1faa-1e30-59e7-b1dc-369516b2ee8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:44cb47a3-7702-5005-a5eb-e9f791d59343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:61777afb-7696-5293-90c9-e681958ac672", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.12" } ] }