{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:16a57bd8-5e28-5ef6-8c4e-c6c5a87990f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:30977783-eed7-5186-8dfd-8cc773635760", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:0592edec-f8d6-5349-949a-d39c8499b393", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4aa08e2b-253d-5164-8369-df2760639b27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4be909ad-c02d-5d87-b45e-89f240dd7615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:278411b3-06cf-5e83-9afd-83f0f17b03fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:069e5a09-1e9f-54c9-ad8c-8181a36e9fe4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3fc7c6f9-e187-5fdb-89c9-4e8183f1b04b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:40b167a6-8c6e-59e3-aaf0-6623a1948c17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:2f38364c-c4f2-59e9-ad3d-c80dae8b155a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:682941c2-f640-52b7-83ab-163b87c7a447", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ece82e66-dc28-5c03-b99c-94290b6df36e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3106b961-45a9-5383-9a3a-48d5ab4f898a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:be019903-5660-5d39-9067-7e1d12ecf50b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:37a298d5-7b15-5d6e-b861-c9460d7b3754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:5325a4c9-dffc-5d07-a367-7e6fee584458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:64154210-e027-51ea-a13b-1e4bf4d3038e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:cbf85de4-518f-5b2c-9308-e09f10df8a43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ae63d7a1-30a6-5476-8c76-667ed710eafd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3bad3570-b6af-5ca5-bad2-2af508b360fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:eed8c893-9214-5a7f-a776-5a36054e654f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:73ad2e67-bb72-5bd4-93c9-90e7e1f48ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ad45a7fa-9d98-56e3-8023-a15865f0271e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:422d64d6-2482-54dd-875b-6e0ae7b909c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1f621ca8-4d48-5c6d-b0ac-98d316eebecb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:73dc5a4f-d573-5c70-a38a-1ac57f6a9fa3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 CVE-2024-38820 is not present in Spring Framework 6.1.16. The upstream release already shipped with the fix (commit 23656aebc6, using Locale.ROOT for case conversion). A subsequent TuxCare backport (CVE-2025-22233) replaced this with simpleMatchIgnoreCase(), which is also locale-independent. The vulnerable pattern (toLowerCase() without Locale.ROOT) does not exist in the current code.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:38162d82-cee0-568d-a192-916389910078", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1d8e35c6-5212-512a-97b0-5d8a977b0546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:9b87b892-6a33-52a2-ba2f-aeae4d6d92d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:c0abc0e8-0b70-5e9f-8fea-b41d1698c6db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:50ac59e7-a4f7-5aff-8a69-d3665b219970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:63c79902-caa1-588b-ba2a-fd4017ddc71d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 6.1.16-tuxcare.6 of org.springframework:spring-context-support, and is fixed in 6.1.16-tuxcare.7." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ca76773c-2bfd-5c40-82bb-b0fcf2e7c7e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ec7f198b-38f1-5b7c-b639-856c99badef7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:e9837cff-35e5-50a1-af19-1c46907a3cc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:19b8a150-34c2-557d-8088-7705460ac2e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:9f16b891-fadc-562b-92ac-c2305fd913a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.16-tuxcare.6" } ] }