{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:45697b74-2523-577c-9e5b-9e08e5547880", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2", "version": "4.3.21.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.21.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb2a07f7-7e1e-5126-9482-54da17e763af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:630b846c-d423-5971-b164-e034eea940b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a2ffdee-a118-5d59-8932-59630a94d49c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d409f0a7-b31d-57db-af84-d7ec4c9ec3a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bfcdf45b-e037-5ec0-99ba-3a9827f1b2cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1564de3d-b307-5f4d-a8dc-3ef2ddb99468", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:becd7084-1299-5408-a71f-2a24f82a3c2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c23a043-e0fd-5304-b8c2-a18f93938614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10c5af72-edf3-53a3-a7eb-b5c92a302a5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7a462f8a-5bb3-541a-a3f3-e9957694dc56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b3b3d1b4-5fc4-5ed9-840a-956440b8c4e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2fbbeb2d-f4b3-56f9-9a1b-90d937709f18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6957eede-c8a2-5960-bb42-c4e97b5921f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9053d233-7bc6-59ba-82c3-d239b57c1157", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae4bea0f-b245-50a4-a956-4ef0ea026822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54a68852-f70c-53e2-8209-4d6d2ca718a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18cc504a-af97-5616-9bbf-cc725164d06b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:494860c7-951f-52d9-98ef-15e699156adf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d8bea6db-f973-56ce-bf48-d917a2738b35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:59e6d44e-bdda-5c49-a376-07164ce64276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0228ffaa-6c86-518f-bda8-7b608d622ff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:94b264e5-0dbd-5be4-87b5-2146b7c1deec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:45b6cb20-ccb9-54cc-a56c-1ee9bc3a409a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:94491d39-f7a8-52e4-827d-6ba3ee0f5e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:104cdd8b-f7d9-5507-ae3f-777502c47883", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 Version 4.3.21.RELEASE is not affected by CVE-2024-38820. This CVE specifically addresses a locale-dependent case conversion vulnerability in DataBinder's disallowedFields matching that was introduced by the CVE-2022-22968 fix. However, version 4.3.21.RELEASE never received the CVE-2022-22968 fix and therefore does not contain the vulnerable code pattern (toLowerCase() without Locale.ROOT) that...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3d2c119e-0333-5da6-b46d-79211f045fa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b0f95b33-5a20-58e5-9c09-3c9f2a10f178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9bee8799-31d5-5483-bb12-5423d030de13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to the WebFlux reactive multipart handling introduced in Spring 5.0+. Version 4.3.21.RELEASE predates WebFlux and uses servlet-based multipart processing with Apache Commons FileUpload, which has robust cleanup via try-finally blocks in DispatcherServlet. The vulnerable code path (org.springframewor...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86138e73-e3f7-52b5-a905-f61f3a25b049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c66d74da-561c-57b9-8982-c9b36c173efe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8864318b-8aac-5d9e-b606-da81972fdb15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:15ac96b9-60b5-59f9-b96a-f2a728370dcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a11999c3-1053-5bc7-b8ed-a9b4715b2dac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df028362-259b-56b5-aa79-7e44d7fd071d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db8124d4-5a37-538c-8bd8-74ceb592700e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ac92f54f-5079-5c9c-aa5b-b379a6db3261", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7a508166-19ac-512f-b63f-891e106ae27f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.21.RELEASE-tuxcare.2" } ] }