{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a6cb5501-16ff-51cd-bd22-f419f0f4f1a2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5", "version": "4.3.4.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4d384fa3-6256-502e-a628-16bd8935a59d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:166843dc-c04d-515e-96f3-7272c6cf5de0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:38e54873-d9c0-59ce-a83e-a4b6b6e0149d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:17a32d86-d4e9-53d9-a5d8-4609f331e3ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2ba6ad39-f3f4-5765-b216-001b8af3b34b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2911f32b-427b-5eb9-8c78-494a83b14f5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:76a77f12-81d9-5a86-bd56-b48da2129efd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:01948a84-230f-5464-be87-14f72ff6b98b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:12325c76-5a57-5345-9256-2ae40c5ad3ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1deeab81-72d7-50e5-92e5-0091c5ca1a37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3653c298-5cc9-5d46-b45e-2772f4b18358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:af8e6ad1-e636-5440-935c-136b0ffca51a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8ae6e596-53d9-5323-9c45-2002f0e16963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f049313f-078f-51b7-8d44-b6ae42a84b3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6f656849-3237-5c9c-817c-930d09d7a6e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ebd4118b-d1e0-52f6-ab12-93bb5a751a63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c44c2910-2ac0-58af-9fc8-707569e25f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d22437f2-98e5-5030-a429-8215c7afb62e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:cde21759-ad94-512f-8217-54dd4db37ce2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d8b45b80-35cf-5b84-9c1d-135efb80cf71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:729f49a2-65fd-5428-a156-df10bb464e0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:610b6032-5c32-5b18-9d33-b55376ed71d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:539ff486-54bd-53da-8896-d5266bbc647e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:83e3adfc-8617-593e-bf74-272c709426d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8c0170a1-98a4-5dd2-b52b-e85b09b5a4f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:910a0ae5-5dbd-5626-9a2c-39bec3fc2d0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:57e43ea4-532b-516a-ae61-69de53d21668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f725c043-6483-5a82-821e-a6ae1c4d4f7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:34b10f3f-ed62-52a0-bdaa-4c0bedb075e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f9738bc8-bec9-5946-9c63-16cd6e52818f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:25a92191-aca0-57ca-adb5-0a7341ba42ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fed5ca4a-3545-5c7e-8e98-db013452ba36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:12f8c9f2-1e0b-55df-9cc4-3f5b749ab893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:405a79c0-762f-5964-b396-43fd4634fed7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fda977a2-ef52-5d12-997b-e517ae29963d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:531f18f1-6a29-5851-bac6-84f3b6498e88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2e2b98dd-44d4-5799-91d7-5719350c5ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context-support, and is fixed in 4.3.4.RELEASE-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.5" } ] }