{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0120c32f-def8-5fb6-8ced-1ebf6d81e52b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3", "version": "5.1.3.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.3.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d5a92793-ef7e-5390-8993-503f28c899a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:637f1619-0eef-5d74-9d4c-ac0d36d4ce57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:34976608-9e01-5a6e-be3a-21abf34ac738", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8f5e7454-0a4f-5d03-a4ab-9425a268b27f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:396fd476-f3ed-5233-879f-bc98cc19af29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b310f97d-6f3c-5125-8f11-895864179c53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e4418057-67d2-5529-a80d-17f03ca33f0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:6db7cde2-afe0-575b-b9e9-55feced12aec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f638ca08-e5b1-5895-a3dd-0c984452d88f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:fd4cc9c1-fef5-5f5e-bbeb-eb3a2c9f5217", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b55b9693-d975-5c5f-8a44-1d5e1e51ba02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3044a0d5-122a-51d8-a019-35c46a9f5409", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:33804674-cea3-547a-bd03-9d7edb44c21f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:04643fca-2f3c-57eb-be16-cd4ae07f7d31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:0e55416e-6674-5fb6-8bec-0386a6e0d1ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d2d6aacc-74e9-5f87-b1de-45e207c4baa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d4fb6e01-1e3d-5bc9-9cef-66e7a1c38fbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:291a87a3-0283-5bb6-9ee0-c59d18d3d7e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a15ad116-bbba-5fa3-9b59-16e7970f0348", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f57eddc2-45f4-5949-b130-d5f2fd7cf86b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:2844279b-e1a4-52f0-8f02-bd674a3df419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:5f254690-956b-5f15-9361-c09945bcbff8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:549c30f8-8352-5d27-b5b5-08cc20ff9025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7851d908-fb39-5edc-9465-dcebc8169181", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e8987dc4-dae9-553f-97bd-ec2cbe2b2a99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.1.3.RELEASE is not affected by CVE-2024-38820. The vulnerability requires the presence of locale-dependent toLowerCase() operations in DataBinder's disallowedFields checking logic, which were introduced by the CVE-2022-22968 fix. Since version 5.1.3.RELEASE predates the CVE-2022-22968 backports (applied to 5.1.5+), it uses case-sensitive field matching without any toLowerCase...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f417af44-d112-5380-98a9-dae7f8aedf82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:0a45582f-5f5c-561b-81f6-e669a6928082", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7680d190-ba5d-5be4-95b6-34272f1dc0ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:31663e5d-0f81-5592-bd73-94d404b851c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:1bb6a40a-ea5f-5eac-9ea4-e82012ec7fa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b9694c88-2a5a-5d42-9f81-edd15c727522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:83212e92-9c7b-5f86-9070-f17f3c350386", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:5fc715d7-a61c-5889-8a4f-eaac0fb1027e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:64d31a91-3029-5893-ae49-6ccf87e8b438", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a72a95af-4b35-5e23-a2ae-ceb1c4d00f83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:eb60ef85-f1ac-5012-a25c-f0fa971b5efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.3.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.3.RELEASE-tuxcare.3" } ] }