{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1f3c7403-da22-5d53-bb61-eb2c812f01ac", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1", "version": "5.0.0.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e90b94ee-45ee-5cb6-8015-6bff4bc2a471", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 CVE-2009-1190 exploits an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. Spring Framework 5.0.0.RELEASE requires JDK 8 to run (sourceCompatibility = 1.8, per build.gradle lines 114-115, and README documentation). JDK 1.6 (released 2006) fixed the Pattern.compile algorithmic complexity issue, and JDK 8 (2014) is well beyond that threshold. While Sp...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7b139a9-1742-5fe3-9ea1-e2aa90a5c5b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:17f5c13e-548a-5e66-a075-b2c8901718a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aad358f4-e35b-5085-b814-4c7211b620bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cb6394b9-f035-516d-ac23-f254c9a7ea8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:57b6da34-fc85-5242-9ff3-bab84686619a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7b04582-7389-546e-95dd-f4ae520a1183", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6fb0d635-7578-5c2f-aae4-902a5de4097f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3e393865-8851-57e3-bf98-dae6c97c0d68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:30d3729b-601f-5d80-99e0-611ab5da9331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:31aff170-5752-5e10-b610-4808a33db5ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:222f7f9b-386f-57f6-aa09-de8010199299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4b6be97-89d5-50d0-ba14-9d590911e6e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6f9ce832-618d-5965-aedd-07e13bf61994", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:339daaa6-23b1-5661-a550-07972f18e0c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d090a74-90d8-5ab4-a52e-83ec902cb716", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:40f7c6b1-243c-5931-9e75-9987c2cdb19c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:267d891d-f6f2-5203-8a4a-2f741cf8b26e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:88c904fc-090f-5945-b754-02b1d0992050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2ef01719-cf7b-5ba9-b58d-443ed5d9dbda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d8908ee-bd46-5410-8ac8-de3521a59c39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8529026b-e1a1-5b6e-a780-54c4bd976631", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e4ee785-6b73-5496-8754-45823a1528fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a4332b53-8737-5d80-a59e-14bfe57e3b92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c2f24d7f-d3e7-53bf-8273-8453b7edcf94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Version 5.0.0.RELEASE is not affected by CVE-2024-38820. This vulnerability was introduced by the fix for CVE-2022-22968, which added case-insensitive field matching using toLowerCase() without Locale.ROOT. The target version never received the CVE-2022-22968 fix, so it lacks the vulnerable toLowerCase() calls entirely. The disallowedFields protection in 5.0.0.RELEASE uses case-sensitive matchi...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9050305e-e2c8-56fe-9022-2325fdbcac70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:635cd801-4bfa-596c-aaa7-892f3b8c31cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5342f0ba-28c4-590d-a618-7a75dd388c77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26f71af4-feed-579b-8eab-9331925ff37b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8ef345ac-b94f-5277-8f9b-09c6e255298d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05c56533-cc09-50b6-ba31-52793d5689ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2c1eabba-15e9-591f-9af4-c33d85f020a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4cf2238e-0006-5de9-a223-5d88148a1d5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5267101e-1ecd-5db1-b2ef-e4d036459b6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7502d1ea-ee3e-55d2-91d2-b4deb99efa4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:802fbf4c-0caf-5115-87e9-9a8528d942ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59283 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.0.0.RELEASE is not affected by CVE-2026-59283. The vulnerability requires the SimpleEvaluationContext class, which was introduced in Spring Framework 4.3.15 (March 2018) and 5.0.5+, after the 5.0.0.RELEASE version (September 2017). Without SimpleEvaluationContext, the attack vector cannot occur. The CVE specifically concerns the SpEL compiler bypassing SimpleEvaluationContext...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.0.RELEASE-tuxcare.1" } ] }