{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e5e9a1ff-1543-5218-8545-59bef727c87b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1", "version": "5.2.9.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e434258-ca71-590f-826e-baa733a3e73d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a4ff8daa-b056-5de3-b137-adf09f9462ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:61b908a4-1329-533c-991e-33d086de633f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:625f70e0-855e-5a55-aca5-33674fb4f13e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a88f86ca-17bf-5854-b8fd-1a2538035641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9954f81a-a086-573b-814f-1fe5e1022a0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0fe1c1d2-0a8a-5358-baa5-ea40ac229b55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:be8b87be-035c-5c8b-b566-dd60ca79730a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0f2ed1a6-f929-55ba-b82f-27cffdc78ffe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:713468ee-af40-5898-8627-7b0946a1b444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7d3e0c1-d785-507c-881b-969a09df1836", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b005abe-2f8d-544f-a890-d237ffc02113", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc6a55a8-440b-5340-b6b8-86495e620151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d0f3545-e32c-535d-b492-b14efffecfd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1094ac98-760e-59c2-8d85-01e775800c4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f170b8fa-e7e1-5a96-a01d-b02a6b6220b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:11df9d2c-7bfb-56f7-b44e-b6bfddb12b4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:305b6907-a175-5091-8669-9575123a1300", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:df85f7c6-7bce-5802-8cdc-da5bc9e63610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:839e5e5b-9b90-5771-bdf8-feef3a6dda2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e221fffa-02a6-5cc4-8c9b-340bdad82f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eb15884a-2119-597a-80c3-73cee2cec17e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:be3cd604-88b8-5dec-8375-3602eb802f4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:517b99e4-16c4-5093-8fb9-3ab20937fa26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:937c3d1e-daaa-5800-8909-a120124aedb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.2.9.RELEASE is not affected by CVE-2024-38820 because it lacks the vulnerable code pattern. CVE-2024-38820 fixes a locale-dependent case conversion bug in DataBinder's disallowedFields validation that was introduced by CVE-2022-22968. Version 5.2.9.RELEASE never received the CVE-2022-22968 fix, so it still uses case-SENSITIVE field matching (no toLowerCase calls) in DataBinde...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94021bb4-de38-5d65-8710-d3dbdfbdbc61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4d59e3c4-34c3-53a5-a09a-958caa052d5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc69b3c0-d3b2-5679-a55e-a5cc125ab62b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c8fa7759-1408-52b7-b113-720c099b2ad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83b5d9b5-3ab6-5bad-9647-56b9b6916706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22eaf215-8e90-50ee-988b-3e190fc7026c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0225f34c-c9b3-5d8e-aef9-3cf60365423a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6ec16056-c155-54a7-ac94-2e7fd24b4596", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef4a39bd-5e5c-5c96-9668-698d3b17a702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:46354c7f-289e-5699-8d0b-d7437c4830b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b0c3258-1364-5694-b4c6-a8e8ec4f2e4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.9.RELEASE-tuxcare.1" } ] }