{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ff885fc6-48b5-5d96-8b85-8b4144f4f94e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5", "version": "4.3.9.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bf23c2ac-30a0-5444-afa4-2de72485349d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9a3d128f-038b-572f-a996-f44145504ee1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7a1dc522-73ba-537a-840e-561b855b8aaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c385e14b-3552-50bd-8888-26ecccb1d618", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fb441077-5b85-56be-8814-d304e1cd7da3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f02f5bec-a9b0-59de-8f6a-7885bdda6a00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9627d23c-71fb-56d0-afff-606cb18dc6c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:92767464-7316-5475-a8a5-719e8fcbd722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1cfe3239-42cd-5929-b40b-267cc1adb615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1a71eb67-5542-5a2b-a0c8-5b7cf61e2304", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f3409d02-ea7b-56e5-878b-4594155ba21a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:690dc091-891c-5df8-9037-1690fb7807cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9d7f0ad5-3910-5c16-b8a1-023ec5698a09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a157d0b3-616c-5915-9b4b-78cea354c53e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:eb27a3b4-7274-53e6-9321-4077c4dc5c11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:74025fff-45f0-53e8-ba00-7cdee7d4cef0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d7eb81ff-1643-5308-9014-5f61103917c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bb2096b0-df7f-5001-afd5-784a01949a37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5ca4fef8-f296-5333-9211-cb89471fdfcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9e6b1ead-e0b7-5a89-95cd-e85143f29fc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5c3e20d5-19da-5eb3-908e-fc945fc03210", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4889ad5e-a778-55c5-9275-0d7c0f037a38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a2a89ef6-be9b-5a98-a207-47b1245c06ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a5bf6c2f-64b1-53c0-b402-c1fb935d6885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:26755091-3840-5cf0-b871-db1cfb2e74cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2024-38820. This version does not contain the CVE-2022-22968 fix that introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields mechanism, so the specific locale-dependent case conversion vulnerability that CVE-2024-38820 addresses is not present. However, 4.3.9 is vulnerable to the predecessor vulnerability CVE-2022-2...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5cf45005-7b41-59f4-9d0a-11a4aeac868e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:55ba46e8-a6e5-56f5-acf3-eab69ff39cde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7fb3ebf5-ebb8-57b8-a60e-2465ee0a134c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:902d2eba-2877-5a55-bc8e-e0f9148f261d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f7485f74-0315-53f9-80ff-6ccad8da377f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6beeb2ee-1a8f-55f5-be99-0b1db7b20a6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f2687804-d075-5948-9832-888f12eb1e8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:89ff0c92-ea4d-5bf1-8625-9e1add6d6a45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:824769c2-8d26-5386-a750-276d51889790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3f78ba4f-da22-5329-b6a2-93114c3cb254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:df487766-164c-5748-9c36-a8f376f27847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.9.RELEASE-tuxcare.5" } ] }