{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0a7cecf8-cf9a-5f91-adb4-b44365ccad8e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1", "version": "4.3.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5c40e1cc-01c1-5c3f-b6a8-bec241277b5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e3569bf-6feb-5a6e-9514-682c1b96692d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ee82ade0-ca3f-582d-ab0c-f637a973e16f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ce5b96ac-047e-5d4b-a565-0850811ee1ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9981515b-b088-5d50-b811-ef876244038a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d9b9da4-823f-5a83-bab9-7476c986f839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0803d153-7292-5c05-b64d-93c7146aee27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2df45af5-7111-514b-8b57-7fe874141b23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7dcd2ffb-ea06-5fb2-98dc-91179a663e52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:72372b43-e0b9-5e7c-a9dc-0568cac5742a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e3510b6d-afda-5085-b813-ebf5989c1256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aadcd720-3726-52f5-abf0-ddc3924f1138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5dd5450b-fd02-5641-a52d-a48d0a91e2e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c5dd9af3-7ebf-5276-abe5-0b6743eecded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c2d4153c-f1c9-5b10-953c-d676c6313c1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:55fce351-6668-50b3-95f4-f957254dfc50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83c8f165-6476-54da-9ab3-b83d7370633b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ed2b15c-39ef-5180-b19d-0a6af9b33902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5191ae6f-5b98-5b33-baab-85bccb4ddfaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b8b5ace7-dc06-5713-bbed-1107da0d149c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ec6c234f-8888-5807-8475-12db81a0474f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:42b25085-f361-5485-b47b-a8563aa3efd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e3c3b76d-dae1-50df-9a8c-5a7bc3dea494", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:39a0106d-d87d-5aae-8ff7-24fa62980294", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cd70e3a0-c14f-55bf-bd3e-27d91396717f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2024-38820. This CVE is a vulnerability in the fix for CVE-2022-22968, which introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields matching. Version 4.3.5.RELEASE does not have the CVE-2022-22968 fix and therefore lacks the toLowerCase() calls entirely. Since CVE-2024-38820 specifically addresses the locale-depende...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b27d0fd6-04d8-5abf-aea5-ad69fce4574d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b40fe9cb-e4c5-53e1-95ad-3196485584f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fe1070e0-8375-5068-b3d3-dbbd2264d864", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2026-22740. This vulnerability affects WebFlux reactive multipart handling introduced in Spring Framework 5.0. Version 4.3.5.RELEASE predates WebFlux entirely and uses servlet-based multipart handling via Apache Commons FileUpload, which has a completely different architecture without the reactive stream buffer cleanup issue described in the...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef9e70a4-3656-59e8-af4a-51c0f4a6ef93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d68cdf2-d2cd-5b50-92fd-dfc6fe9df360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0b92caeb-32fc-56c7-9643-ce10005b0440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1d2f5045-fd3e-519e-9d0d-1c8df6850410", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7bc6298b-9f0d-5308-8b0b-292106ab1fd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a429c8ae-cd5b-5693-bc7e-74020a6ebb3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:818a5a77-5ee4-516f-b331-7bb020970e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:459037a4-7e92-5176-9c2e-a03ef5186b4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7577b52-08c4-5ee4-847b-d609de069c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.5.RELEASE-tuxcare.1" } ] }