{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c68e660c-6ac9-5fc4-8d1a-54be840aaf15", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3", "version": "5.2.17.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.17.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3135437a-5b77-5e09-bef6-c6d2eabbc328", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:24495ad3-16da-508f-acce-9f3d99ebe0d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:79bc8158-1f16-526b-985a-983aca2ace19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:2f74c670-af26-53d9-9554-197c849a95e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:eb48122c-f5f4-5683-9fe8-06723c0b5641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:34fe13ce-38b1-51ff-9601-b422d1d42596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a09ff374-dec7-5745-ad03-cf83c958b061", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:65a50f74-e9f2-512f-8eb5-1467a7402f82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:4a2a7601-19e1-5bd8-92fb-27210557dc8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e082a168-8196-568e-9b4b-9377935f124a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:978d0515-fd89-5f90-b49a-2099765756d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:92b7696c-0230-54c9-9104-958bb304454a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:07d58416-3d56-5040-9eb5-0d85afde5022", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:879d8d5e-a6ea-5da7-9426-1d298a66e3fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:9cbc1736-36b0-5425-b896-9ce8adc29ff7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a3f4129a-0851-5282-9f78-7061af81601b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3ab39bbf-ac70-5a99-81e5-c811510cefaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3c46719c-1028-50cd-80bb-7173fea8edf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:951fa7ac-eed9-57a5-8a54-98a71aec7e1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:17caf7d2-c08b-52ee-ae28-e6ef34b591ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b8d9c59d-5e96-5cbd-9180-cf190470b6d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c268a1ae-4a12-5200-a15f-fad417ea3723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ae5a206e-76e3-58a7-9edd-b2d644f97f85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:6d91fd91-abf4-5420-98ca-06096f91d9e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:47fae4bb-39eb-5022-b173-1355144352d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() issue in the DataBinder's disallowedFields protection, but this vulnerability only exists in versions that have the CVE-2022-22968 fix applied. The CVE-2022-22968 fix introduced case-insensitive matching using toLowerCase() and was first included in Spring Framework 5.2.21. Sin...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:9e5c3c9b-9d63-51a1-856f-9635e09e6b0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e8fee4ed-da9d-5f40-ad28-be10f6052743", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3b45e8e5-5ab3-58f6-b36c-9ec2becf465a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:33fdceab-13f9-5823-aa5f-ae5da1b80e70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:addfead4-5cae-57d4-87d8-248ae5123140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c3bebeb0-0c7b-52d3-b154-af53ab271efd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:700d66bc-752f-53f7-8a23-86459a75fd6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c177f9e3-23f8-5aeb-854a-47625d65811d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d63844c5-bdf1-5cc8-a582-3762be3a8e3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:06e82231-b67f-5696-8b1f-55983eca8d16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:9340f220-4846-5e5b-93cf-d178e88efb63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.17.RELEASE-tuxcare.3" } ] }