{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a6d05826-a97b-52bd-a74c-3276a07745ad", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7", "version": "6.1.4-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:ff70b0ca-3ddc-5f6a-93da-859dfff3421c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:05cc27b2-a196-513f-a066-d54501c0a126", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:cbacc57a-5241-5b16-b435-b5eb2fa5f6d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:5f93ab12-e2b4-5f2c-8ad6-b721b6521e4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:21c07b79-99dd-5447-9d77-7eb7d58fedfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:61164f40-553a-5af0-ba05-b0b3f1ff4a6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:4ebfdb9a-6729-574b-acff-1a102880e378", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:7032db1e-95cf-5e54-a974-8505cd6a7ad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:c48ef701-b4da-5360-808a-d9ff9750ffd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:31373c2f-37e1-5729-8cfe-ca0eaa205872", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:fef249b7-265f-5cd3-a9e8-e20fc5d84615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:663a403f-fe85-53af-8496-9a65c77d54e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:30ab88af-6787-5d2f-84e2-2efde1eb2adc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:e8a6d941-004a-55c2-bf00-8768e594e611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:3a0342a4-4b4c-56b0-a7bd-b5edb8f82237", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:d69b0ae7-7caa-5d95-bed7-2c2050bf849b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:021a5b44-26ec-5530-b764-2282a5eb1147", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-beans. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:681891c9-dec6-5a83-9973-9f51a29be2fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:efa5b6e4-47d5-5c99-953d-eac41d62a8e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:47f0640a-c14c-565c-9aa1-87a45a71769d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:25122395-408b-5fa6-b781-bf30eda10732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.7 of org.springframework:spring-beans, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:db9da181-c116-5d24-aeca-cdc27d532037", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.4-tuxcare.7" } ] }