{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d49bbd9c-e648-5697-ae0b-ed832fbe98d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7319176c-a923-533a-88ac-b4167e5a4eac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a474edfb-5466-591d-ab2b-893e5a844ca8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9e778557-9d7f-5d93-9615-f0b978b4019d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3420c4d7-cdac-5954-bc46-b4d01e971fbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b2ce0d48-af08-5bd4-abc4-e0936639a672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b3eb7146-69f1-5293-9627-34f00e4676b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f8c586a1-89f3-5999-ba43-93a0a71c7127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6e2188c3-cc7f-5b2f-97bd-c8af401ada9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c1c3c792-0783-5f71-a9aa-3d1d0d132395", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:22ede78d-f1ff-5fb2-8c99-de67f07237dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:30a7d4d7-249d-5316-a83e-c99399e4ae7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f78d2889-5f82-536d-849d-6ac88f11d88f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b73ac5c4-5ecf-545d-b5c9-a34f4d961eb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1fe6ef64-768d-52cd-8932-10aecb8793f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:369550e3-d241-5b8c-87ad-33d399b86161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e3d055a2-a390-542e-b671-245fa3e7835d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:36c8607e-3a54-5499-9332-2164fa09f462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3191ea16-410b-5dc8-9420-b9b07b3022b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-support. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:615c65ec-4558-59b2-a241-c1a0135a9707", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a5c853da-8f73-5091-935a-4a965cef1f59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:68904386-2f68-57dd-8dd3-914c71d64d6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9fe6709a-1576-5624-9a33-e79d3542d8ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8b8a20e2-17ec-51d4-a520-cbf86196f93a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9146fea2-2b38-503f-ae98-ff34ef022ddf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cdafc1e7-6136-5f04-ab61-9b24d2ce6c2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5e34ba36-1010-5a04-baac-d918908c9cf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a991ab23-4889-5ec1-acae-4163820e1f9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:dbcc98e7-feee-52e0-a7a9-a4f364f47291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3f10adeb-077a-5ea7-8b9e-b0698baf94c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c8000e23-6aa3-58a0-99d0-fd641e55b042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:26bdc39b-5a0a-59f1-b0f8-d0f45694a3ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a4e90506-df88-5017-8c39-85a76fdfc19a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:40f8c7c2-2d5e-54f8-8f8a-cc2564232570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bc8ab890-c0b6-5ae3-8d77-e7fc121e5fa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:442a780d-7b08-59ad-a49b-6b5325d5dbb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:32d21755-8226-5ee5-9067-82b33efd4a14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ] }