{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:76644941-0f1c-58eb-9836-b19b6d370616", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6", "version": "4.3.4.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:25ade6e8-4ef9-5cf5-bde3-2c09ad1c04c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d5206fb9-0412-55b9-af38-33435b3fc0a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:772bb707-8feb-582a-81f3-de435173f3ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:239a5dca-8631-54bb-9e7e-e6de1568a6bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0bdb28ed-8dd1-5d90-9364-6cd91941ab28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:eac85498-31d7-5fa6-8933-e017b3c0dc6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f7af2b38-af79-53c6-8a7a-5654cb6c3fdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a3d9c5cd-4b12-53f9-a046-29b7d68c1d29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:12af20eb-3967-5ef5-b9d1-6f1201322634", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c0fbd058-de39-5f5c-84ca-8644a98f3345", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d5599cb6-e2bc-57e1-82a1-4a249ab71351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0ebff7af-1d54-5912-9b0f-b86fd4dd4d50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b00bb6fa-d977-511d-8497-9967be0df04e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e29a6b64-1123-5d97-88bd-c396cd487f05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:26ea9f75-f46b-5752-83aa-c53d0ffa5a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a60738f8-7058-5fa3-96c0-b3511e8f3e03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:be35dd18-8809-57ca-8b1e-a4c52c3b3182", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:18f7e8ca-36fe-5fea-8ca0-e0846dce8cd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0f1e7b3f-8944-5adc-99e2-cc8f796986c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c8f3c6f5-29fa-5100-88fc-0df161e67219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:93105858-ead3-56ef-8ea6-8259ee6d9143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d9c955da-5f10-55e2-a430-36b7a44326e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d1c2c609-e2a3-55ca-978b-d1a6ea18a8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:947a8f3d-24fc-5a16-8d4d-c26b774b7b9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3f114640-3ecd-52bd-823b-4227d854da7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:79db7c3f-f033-531d-a7ce-11568a07f7ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:605a50c6-66ae-5967-a7b0-7ee0a6861091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:58175834-2a14-52a4-be96-5c0bdc136982", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6f9dde90-bace-5b85-9fdd-6c13d27ea042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1211938d-1088-559a-be87-333edcdae61d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ef059d3b-777a-5bd7-8e17-c453d3faf9b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:629eb7e2-b7b1-5dfd-bcd4-a1c926916260", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2f047643-7dcb-584c-9183-7fca1fd760e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4672f474-7a7c-5ac5-b6d1-4029497d84f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b92eb056-ec74-5737-820d-12524af57782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b0c774e3-942e-5729-840e-3c0194a46842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:22dc2319-adc8-5ecd-a6ea-65e5b67e6493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.4.RELEASE-tuxcare.6" } ] }