{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:375b2d1d-584d-5a2c-b7f3-ac16b736a725", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1", "version": "4.3.20.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5085197b-9a9e-5418-b309-93a4c0dee0c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a620a5ec-97f8-5cc9-9cea-f2d7b74613af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e423a273-3a8f-520d-b33e-2455fc054dfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b024eebc-49e7-5017-9185-675ca440d445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:de54cc51-70f5-5129-bc2b-6d0fac795ad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d494659-8528-5477-ad60-bb637763edb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:00b96128-b984-510d-872c-5e538e84c00c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:094df728-efcc-582c-9037-3279ddfc774c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:378d9849-5786-5f66-9429-6fe5f5663f82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:72c29cea-2b66-5f4a-b2e7-bd72a618b8a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:554771a4-07da-504c-aa55-7058cb71e03f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2a3fcb5-0c70-5c28-9fb0-167f0d11707a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c2d0e56e-3320-5b66-b416-265f69805236", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9f7ece77-8043-549c-99de-33f9acf92ce2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f89b4876-153e-589b-a1dc-fc0ec58de52e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:81e7c7d0-3b1e-56ae-9098-f19f01258a59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eeb65596-2792-5a3d-918c-52c96dfbde73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context, and is fixed in 4.3.20.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dd7a404b-295c-505f-9973-0ffb9f0d8f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e09dca02-82f4-5a27-8151-b4d3b0190dbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9fabd257-36d7-5630-a564-ed38c8a943e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83c75438-06a9-52f6-82d2-3b2acdf0a65e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8bafe54d-ad71-5d2d-8e93-2645455ae502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cc98e696-c4c7-58ae-a1e7-4a3d5f3f8b7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:793af93f-f775-5d67-aace-b0826a5e4309", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:01da091a-08f8-53bc-8811-6c7664b8e0e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:429e8538-9d63-58e8-bff7-7fb1f2ff38cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b9b61f67-a130-5513-a159-a7f8aa4c8c57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7212436d-d426-5cde-bed3-b418f8c60b65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fb30aef8-b313-596c-89fb-c57bc42fab1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ed9c61e-da25-5457-8628-016dde73b151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:339240ae-eeb3-56c7-8a5a-4442826cef11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8c2865e-7bcb-56f6-bc99-d7ebfec66a85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1dea0c92-7f22-5155-bf51-d2ccdae5c16a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6271747d-e6d8-5b97-87bc-2518834589aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6a740a8a-1df1-578c-876c-2942978c9419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.20.RELEASE-tuxcare.1" } ] }