{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12c346f1-eb4f-58d6-8e88-0ea7f0cbd454", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1", "version": "4.3.26.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.26.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0a82e57a-b795-53e0-aecd-be09f906f15e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da72c1e0-874c-5cfe-b65c-568abaf71e60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fe869e63-d783-5abb-91cd-5f1cf90f4061", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3dac506a-5a10-53e4-81f9-81961bd722b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8523f59b-c60d-5c47-b92d-4a19a7a198fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b91d6f9f-61c4-50b4-ab74-a205b3271592", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:73457ba0-9f7f-5d90-bd01-08762e2cb2ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:79d5e91e-a4a8-5aff-914b-6dd1002b84f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0b443a13-edae-5fe3-ac96-6a55b3894efd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d83f56c3-4d91-562e-b572-24e63d35630f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0154edf4-fc56-54fe-9942-e23579ba8172", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:60960e39-09e4-5f28-a684-28805505fabe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8b4c7c82-7391-59ec-9a43-997a22998450", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b33aa4a-abb0-55ed-8a6f-50705c87c21a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d17537b6-d86b-52f9-87a2-95669b9370ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:21a5cf61-036f-56fe-88d5-c321eb15cca7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:16da202e-ed1f-5f95-9a76-a2f7e199383a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d79592e-a77b-59bd-b5fb-3976a89a4646", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7306c54f-688a-59c6-9b39-1cf7634cca9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support, and is fixed in 4.3.26.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1ba18f3a-0231-5e9e-b41e-f5e41736b171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2fa4ac0c-bc11-50c1-8564-24c0ada03f6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9906481a-af2f-52df-9687-27b1f510a46a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b6c83fe3-69ba-5a30-ae1a-09c78767fdee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6240675f-4568-5fb6-ab51-60ca5459ffe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c2dc8eb4-4505-584e-913d-5714c80d9b14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Version 4.3.26.RELEASE does not contain the vulnerable code pattern that CVE-2024-38820 fixes. This CVE specifically addresses locale-dependent String.toLowerCase() calls introduced by the CVE-2022-22968 fix. Since version 4.3.26 does not have the CVE-2022-22968 fix applied (which added toLowerCase() without Locale.ROOT), it cannot have the CVE-2024-38820 vulnerability. The target version uses ...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e1212680-9757-52d8-bfab-f22e459d72c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:533bea22-f282-5ddf-a803-4443ab006678", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e59a7ff4-9576-5ff4-985f-ff70a08b5d86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.26.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling, which was introduced in Spring Framework 5.0. Version 4.3.26.RELEASE uses traditional servlet-based synchronous multipart processing with proper cleanup mechanisms and does not contain the vulnerable reactive code path.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1da6ec9a-78a6-5581-9bb0-cf29d17876a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5e199858-77a4-5c11-8ca8-01f8d6181eff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc6bb5dd-ac96-5f48-ac8b-49fb87291e1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63275440-86fd-5efd-a9af-0f8f4aacd0bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ee19c1c-e128-5dae-aa26-d2fb92e7fbd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1723e772-ff9c-5127-8fc6-d2b0846d62e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e4e11b87-4911-50ba-abfe-8df466e9d4ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a32bc55-e6ec-5ceb-b4e2-98c82367a6f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f002927f-b526-54f3-a65c-0cafffbd5b3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.26.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.26.RELEASE-tuxcare.1" } ] }