{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:53b1d493-0543-5268-89ed-a53f03cee7d2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1", "version": "5.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22951ff3-644f-54df-8ba9-085d292a1c5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5caf98f4-5b69-579a-a32a-be9fe8f0b79d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9c0ae035-c955-5946-83c0-28731c9fa0bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bef117dc-306a-5e03-9bc1-32f085a9064c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:204a9775-91fa-5c8f-8223-0e1b06818b06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:76d8853d-b1d8-5aa7-90f0-b09668b01484", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc1ee51c-cefd-5003-9359-bf14c6a7ffd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:03c52b1a-4e02-5df3-b578-4e34399c6941", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c1605709-a8ec-524c-8a2b-4f5a08c8eb85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29cb2ae5-e7ad-58dd-ae36-ecfa7dcf2519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fd756a74-afc3-5e7f-84bb-faf64bc427ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fd9b0dd2-8bb3-5bc4-a59a-519483f64ae7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e59e9df8-dd7f-5725-a4e5-a84ebe4079ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22b09d9c-7af2-5199-96a3-ef7411dd46a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4b0e88ec-7585-5cca-afab-cc0eba2c43e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:42410f29-3b1f-586d-96fb-e6fd664d3ff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b71f902-06de-568e-b2b5-84241d77e6ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:567cfd17-33ec-5950-b053-6367574ff14d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6eb7d10c-5ada-5b6a-a107-4b26b4d2f2ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:50e7a8ae-1894-5879-854c-46a913aed838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1f990342-bf71-54f2-a364-2cc7204052bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:98655d74-0c72-5094-bde1-5fcd20a7d90e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:90213328-a855-5a49-8777-10b69ed9f444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:23407d37-e8a7-501b-9458-aa32465018f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9c9c0e52-b414-5b9f-aec5-9c1ec07b2cd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7f319c4c-1bd6-56e8-942d-eea562ff681e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:08bdc5f0-2a03-51af-9f4d-3236131b4a87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3b28ae1f-bb94-5d77-a3e0-441abc3721b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c75fb635-087f-5a76-9742-b7edd6eb2cc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:364f4e20-fa86-534d-b1d1-a9147f856075", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ad1dc4d8-5598-5ab5-8bd9-47bd13b12432", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d2bf6619-4ad7-5ae4-be89-0c3c167663d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d8ba716-a963-557b-9c22-f51cb1461fda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:40d67bc0-216e-527b-89f0-9680c806acb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b83d383e-afef-549b-ae4c-039b21ecba16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef6c5fa4-f877-52c5-ab53-4778e67c89eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.1" } ] }