{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c407cee1-9b8d-5371-9e04-28fb0b886726", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3249d04d-29c1-5ebd-9408-e81780b099b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:467235a5-6604-5a8b-92e0-7129607e9848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:95f8203c-0eff-5138-aa3a-794bb422bd45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9be082bc-d5e5-57bf-bdab-a32c237367f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e282937d-bb9f-5589-b379-9c64183a8e9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9e2c1511-fb21-58ff-a967-a4f90e5be864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a60276cc-0cea-57e3-84ec-4d085fdcf1cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:309b4dd2-b0cd-5172-af23-6cb005ab75c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c50f8c3a-4fbd-5574-9ecc-5af2397c0b19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4efb28ba-6958-5e17-bfa8-2076703e3dce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:05087631-4f44-553c-89b4-0d7bd27fc178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:256708b1-f1dd-581c-9cca-9695063029d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:593046eb-0d07-51d8-81cf-660e2d78b991", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:03fbe839-69cb-54c3-a373-9736755d0a97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ba47040a-eef5-5e50-9eea-8da2e0dbd0c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b5fc42ab-6e1d-5d4f-9dd9-f027b98f73e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3926c1a9-3cbc-5940-9ac7-b810f7a0a1cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5af0c35e-7876-51c5-aac7-434e51ef0b4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:341220e9-7e18-5608-9d10-04f9dab24ada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:08132fd0-ee34-5b99-bc27-9a53779dd73f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8238b6a2-e6e5-5f4a-8d00-5eeaaf7f845a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d21fb600-1b70-511d-bf69-3db8f6c72d46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:abf1bcbf-cff1-5dbf-a647-a75dc1eca577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9abef373-1f42-54bb-8d3d-06190f49dee2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:04f25488-9e0d-5212-a739-4fca617e4b77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 The target Spring Framework version 4.3.25.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent case conversion flaw in the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix and therefore does not perform the toLowerCase() operations that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d61f2791-73c2-56e9-b2a6-eefe1dacabb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:94bfb5ad-8d7f-57f6-8d61-67b9e1ddc1c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5908b36c-29ea-5487-8c43-8f12fde9b6ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:284e83d6-ce08-5d60-811a-a40fd721d1f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e5ca6700-78be-5488-af1e-07e2b0621ca8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2bb3749e-ab0d-5da0-8a2a-ee620f92d6fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8a53d883-7c57-50c3-89fc-2cc77a2f0728", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:648f4483-69b6-5b9a-87e9-a4fde99c0ea8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:305b7043-00bd-50ee-b53a-3502a3af507b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e15fe1cb-6d54-5c27-a9b7-dd32c0518ea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fa29d6ca-383e-5cae-a52c-5a9730ba0216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.25.RELEASE-tuxcare.6" } ] }