{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3dc2f9e7-1355-5afe-80cd-48c906224cbe", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e68f74a7-2a66-5b9c-9538-0a4b77d92edd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b7f4e4f3-3651-5b62-b8ed-f809440256f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:46e7a79f-f7e8-5f41-8b62-91a4057dae30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0f4e0153-0dac-5f95-b100-e245ea353986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:40d93650-15e0-5fbf-bfed-c72a0bf1bc15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:be642158-6e5a-52a3-a859-89892d379922", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d2b585f2-08c8-5e99-92a1-e2cb5b155c47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:92dd663a-0887-50c6-a3df-1e8b20e407b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c5f9c82d-9af5-59f7-8b25-b57226535a3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2df10ac9-6861-51a9-9e94-345bc07dca86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0b6643bb-02f5-50aa-8845-6a4bd38de9e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2e6d3f38-3044-59c6-ac07-61a8ce6acb19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:52e63f1a-ffcd-5087-a364-6c57b6597028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:52412dc7-0382-51b1-91df-d135d0982c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:dc0f433e-d75b-57ff-bcbd-8e70b999d2df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:537a0cf9-c491-50d8-9f9f-051d15c70984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:41a73349-40a6-5886-81c9-7012b8689ae8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c43ee172-1c99-59c7-858d-77cc4e425ff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ff90e411-7544-5258-b773-1fdd9a6db270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:37ba7000-14e7-5408-90ce-595de88d8337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5f573463-2362-5ed5-8c7f-1ebaf1406b29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6e727641-a5da-551b-aa46-a1706b6bf068", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9ae0d1e8-adce-5860-96a7-7369c2b148c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5a3f550a-8ad1-5474-90e2-7b05e8590dfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6a1ac107-d005-514f-86c0-ef47e1a4f7cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 The target Spring Framework version 4.3.25.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent case conversion flaw in the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix and therefore does not perform the toLowerCase() operations that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:36757a29-9bbf-521a-96f3-34d0b23a84f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:50238370-1797-5cbf-9c5d-340f5b7e2906", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:aa3f3091-5533-5d8e-8c00-dd889012fd9a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1a41bcb2-149a-5437-bb70-28317463352d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c2633951-0e21-5896-b8f0-c20eea08ddc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:17712d2a-c667-5d87-a612-11711390bcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:dec4c319-4282-5992-ba26-334e930e1613", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ecbf3c6b-0393-530a-b5ed-84e532e7a514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a647ccff-07b1-551b-90a8-1583500be02d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:73707626-4b3d-507e-8312-6a8b6d66e831", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f88c6803-1058-5eb5-a9e3-be6ebc69b9d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9e00a3a7-a82b-583f-99b9-aa68602ca25d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.25.RELEASE-tuxcare.6" } ] }