{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c1d0adc-61f7-5ed9-b3ff-57f9e9115e65", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1", "version": "4.3.20.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da93b5df-89ae-5efe-a31d-360cc887075b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8512e6df-c716-53d1-bf70-e18b30d27447", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c516d209-5172-5b04-acf6-5f6be6bdad29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d20c4c59-d6ff-5973-9c6a-8a64ad25e9b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5451a2a4-5444-5ee3-9601-f1de45ca465c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9a6feace-e579-5007-ab03-a0137d0c6f56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a5673690-7853-5245-9960-446892e2936b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:73d6e70b-bd1f-58e9-9beb-2eeb16d4e9ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1e8060ba-7176-520a-8d1a-80d2bee043aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2727dda0-5820-5d68-94e9-260ac259f0b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:95c527cf-524f-5499-8874-1430d60fa9c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f96f7fe8-a0c4-5577-8822-8e059af3e4c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d9b03cd-925e-5a69-ad2e-aa16f90a58b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b465482d-d90d-54e2-aac2-d2e261ff25da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa8ad09c-6e2d-504c-b536-eae46617fd0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:70442733-48a6-5a04-af6f-256c7e8bf220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e4496995-8f8e-5472-9165-fd93b93ab583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support, and is fixed in 4.3.20.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f612c46a-530d-5850-a5a4-31a68008bed0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5612d149-045d-5eaf-87e0-19e9c85cbb07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:042b6fb5-b904-5031-a179-c694d76ebcc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:57c8d03b-4ead-50d9-9bef-c06246a06dec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:400fecd7-9b1b-589e-ae48-696dc164bb25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7bd2aced-3e9a-5cee-aa89-6455acc33908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:44dec058-6d7a-591d-9ac0-e9ae9af68fc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2147c0a-b2f9-5616-89ed-efb824119482", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:574d938f-a5e6-592f-8742-9e69eb95ac59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1df51e17-0ac3-50d3-b161-c1836b220c04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f3e944aa-2201-5a56-9686-40363d6c6713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:14dc512e-e9a7-5b3d-a64c-d0f379f3a154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9e978837-a4ad-52a6-b65a-e6d55d3dbb5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6081995d-34e3-564f-a042-110dd6179b38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5549acd6-d8f6-5773-a42b-8006c3b2684c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:39b14498-efc6-5c10-928e-2a1d9ab8f225", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bcae1f53-8665-500c-acd2-f0b1495c2feb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d4178f8-ba27-58c2-9c51-07fee4f451d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b20ee353-3c33-5141-bd5f-d11e6096aa35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.1" } ] }