{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aa1ffd64-e34b-5b97-a3d1-2bc7bf01ae88", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3", "version": "5.2.11.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.11.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ca2435d2-0be1-5dd7-8435-0412c8324189", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e96d4df6-981b-57db-ab50-a2620994b8f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:afea2f31-c5ad-5d91-8e28-07250d386eda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:0e2249db-f1f8-51b7-aaa0-9906a7ab7cef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:44b2b1a5-1e62-5325-b7ac-cbe33554a8aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:14cb29fb-ddac-5a2a-9d32-3341fcad578c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:be37b407-f07b-5ab1-a9c6-67aac051a04b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:11bbe94f-ac4b-510e-9cdb-8170e149ae92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:0fca9a79-6541-5d26-81b6-7d64e993de28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:436a26b3-7c6a-560d-befd-95b79e249d16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:fab5be4b-e805-5cf8-b3e9-5e3103ee5a3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:2d8200b8-611a-5ce0-aa77-0229a7945aff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ca8b0adf-5b4e-5987-a357-452b645b6ccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:37058222-3d6b-589b-88f3-e456e76f1ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:69be8033-b9d5-5199-b251-56b235333b72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:0332a1a5-836e-5fee-a434-d2c13666fe3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ea7348c0-547b-524e-a7d2-7b1cf0348389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b69a797a-3006-56c9-bbe2-c4ab4f15c37f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:edcca402-6943-5c1e-adec-99026e4e3339", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:541fc2af-8a20-50ac-866c-4bdb4b428b3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f1387d46-82d1-51c4-bf25-6468de8ec71a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3825701d-3b94-56b4-9684-18f99f1a291f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:311932b9-ddc2-5d1a-b238-4794bcec9fcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b71a8459-4f06-5e52-8b03-3598b5d7bd9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:39806199-d308-50b2-afc1-cebf363ddb93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support. not_affected \u2014 Target version 5.2.11.RELEASE does not contain the vulnerable code pattern from CVE-2024-38820. This CVE specifically concerns improper use of .toLowerCase() without Locale.ROOT in DataBinder's disallowedFields handling, which was introduced by the CVE-2022-22968 fix. The target version predates that fix and does not perform any case conversion in setDisallowedFields() or isAllowed() methods. T...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:9f94affd-a9d9-58fc-9cc3-7de8b0e1cfc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:6706a35f-bb39-554a-9653-36f030c141df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a71c39cb-b5fa-5e60-b25d-bb410eee90b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:72390a7e-eddf-5457-b263-6e2d423e5f4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:17966b31-7088-5046-b1f8-93d45bcc1f01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e4dafa20-ba81-54f7-80ec-2f5876a6c45f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:332ba6e8-7aba-5973-b54c-93beed31b3f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:05088182-ea91-53bd-8ee1-0ece8ecef166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:2dfc5b0d-4d74-596d-a28e-109d9d3a4352", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3b296cc6-3ac1-57e3-bca0-f8de7570f415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:83ee7571-7b4d-5a27-a035-a68b1daabcaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.11.RELEASE-tuxcare.3" } ] }