{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:de61fe06-248c-525a-8577-419cf58076a5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1", "version": "5.1.7.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:caf95859-34ef-5ef4-80b8-d49af0b85770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ef9fa4c-9a6d-5f76-9ae2-5c43d823e439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e3b1cdd1-8cbc-5f95-91e8-5131e7c3f43d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:31cefc79-a3b6-560e-9b59-52f4dd5b9b44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0e1dae6e-f1c9-53ef-94e9-70bcee5d363e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e9fc109-1d3f-5526-a7db-2abb5d492098", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:220aab40-638d-537f-9a3b-1519c6992a6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64264f52-7b07-523e-ab41-93a305436544", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b2b2e96f-811b-5cda-b033-d7e264b9edd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d223255f-03fa-50f3-ae09-1f67aa0f6f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4f1068c-c093-59a1-9c66-b6795dfb8d00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e9456eff-94a5-5a68-ae50-ca323ef9a951", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f4134abb-13dd-517d-95d1-f39f1deb496b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab3a99b9-ead0-5d45-8aa3-810ea31242b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e81d93f3-5884-5b4e-a023-22072e65c84b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dbc6205d-54e4-5905-be6d-6fed102e6ada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:24d4b6fe-5cc2-5cc8-9992-bc042d30832e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4809951f-22d9-5402-8f0e-f7b1d3b9dbea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4b07b539-1e85-58bf-8874-0a59d2a51bc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d14b34d3-fd40-5315-8f28-2c0580c7a022", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:923251c0-69e1-527a-92a0-ba510feacf2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8d4e8a54-1f8d-55b1-b734-a835c65758f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb1fa99e-f7a0-5383-b0e3-2b5f5b1b8219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab0ada43-c0c5-5847-84ef-8a85a03797f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a638eecd-1186-5722-ad64-88269271af04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 The target (Spring Framework 5.1.7.RELEASE) is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields checking that was introduced by the fix for CVE-2022-22968. Since 5.1.7.RELEASE (released in 2019) predates CVE-2022-22968 (from 2022), it does not contain the case-insensitive disallowedFields checking code that uses t...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bf38866e-dca6-513d-9d76-e939c7ff3e8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1c6f8266-a607-5dcf-91f9-f752990306f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4bb6cb09-c707-5ee3-a0ee-3411b10fb90d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:126db83c-ed79-55cc-a16f-71b86e837cf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support, and is fixed in 5.1.7.RELEASE-tuxcare.2." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6ad76828-82c8-537f-b43d-7be994c6805a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4164594c-1824-58d3-b5bf-2b7838e8ea9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:467dadb6-b3fb-5656-8d1d-9f483bda5422", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:52403229-6a07-57a9-aa91-34fa8d383923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49e75b51-1b10-5cfb-8f8d-71939891c721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0092b81-c4c6-5b2e-a563-d9b84ddc9d69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5c003527-e208-5601-bb33-e2695850a573", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.1" } ] }