{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:42830fce-37f1-51b8-ac72-d1c12cedc88e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:e212c772-aa86-53ab-b632-7e6a3bdabab7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:027433be-6c06-56dd-b2d7-77a53df28484", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:2ec74049-68fd-58fa-aeb4-3510db260708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:abb71ebf-27ee-54ed-aebf-6f23f89125ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:44d5ebb8-92aa-5582-af9c-597de3d92091", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d7a67465-7c18-5442-b533-26598ddaf9c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:cc5164cd-77e3-501d-bc9e-09913cc7b9a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1fa497dd-f41b-5be1-9ecb-bcbd80552b0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d751a437-404d-522c-939f-7cc66db647cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:40917499-9e04-5646-a940-129e299ca5a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1d22f5d6-3fb2-56f9-966c-e67b88f03027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:52c737b1-51d7-50a4-b71f-66aa18b8c292", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ac9714a6-2986-5391-afda-ee2b2875acd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b7050d58-8b89-5ba4-ae48-31c18929eca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:938abad3-586a-503c-835e-bedd2a1cfdae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:f37af54c-06cb-505d-a6eb-09b407653586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:97fb6692-2a5d-5eff-981d-7e8691f08f8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-beans. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:fea9d398-9fc9-589c-ae17-6b3960b4a331", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.1.16. The vulnerability allowed DoS attacks through file upload data binding that triggered repeated property introspection of MultipartFile/Part fields, causing resource exhaustion via unclosed InputStreams. The upstream fix (commit 83186b689f by Juergen Hoeller) blocks introspection of read-only properties returning AutoCloseable types (incl...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b434c56b-133a-5d94-af71-75508fe62632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8f0a410f-7675-55ea-812e-112b03f1edcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:a886c594-3003-533c-b285-8288114d0da5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b8210044-2e53-594e-8979-e5e9b253bef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.16-tuxcare.6" } ] }