{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e171e3cb-2297-5221-b2b6-bc4a949642f0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10", "version": "4.3.30.RELEASE-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.30.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:194409e4-43cc-57ae-b89e-b70c97226fc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0bd17d1f-ea61-5a95-a2e7-2025c452ae99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:71eb3b5e-2f15-5c7e-b126-427ec27c6324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e1c041be-4207-5bd9-b2a9-3cbafca8af2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:3da81335-3ec3-5bdf-9353-9dc92d8ba09a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:34d9e441-d3e6-57ce-af2d-b4707ca4d73c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:28611762-b6a2-5be5-9c2f-3da1c448aae6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ccb23976-5ddd-51fa-bce4-b3bc3a83f0c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:70e374db-12ef-55c0-b887-b73d3faf4c77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7d7bb10c-93b1-55d1-9cb9-21934d92d51b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0e350493-e96a-5fbf-86a2-bda587bbd1a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b2b86c00-ad7d-5242-9e45-8a881654dabc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d13bf097-376e-577c-9e92-b0b57439a533", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c171ab81-2e80-5a19-8335-d026717e7a08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:64b5c3a1-c732-54c4-a307-ee0234245305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b9a3b532-3484-5eac-bbc0-4aebce54bf65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0a589ab5-7c0c-5d74-b293-c30f00d681fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d8206b47-fee2-5639-aee9-2f6728ec6a96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:70ac45f2-b6a0-576b-ae47-9faab45cce81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c2315d05-c53c-5e01-8363-8b95e00815c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:567985e7-abd4-5d63-b280-023dfc8caf0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fa183b72-3144-5fd3-8d6d-ee365541e26a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e6556050-e8f3-5857-9e31-896c9f3568e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6bae4b40-0c56-5dbe-8514-838771757fcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:9ff9ddea-aa77-56b0-9b29-77557cbf55e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fe292e43-670c-5f4c-b3ab-38fbd273bfab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:a924d1ec-de95-5c0c-8b88-18e2b5f799be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6e1130ad-41da-53c7-9963-117862b4619f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c2c8a9f7-3b26-5c96-9a5c-aea88f32efe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:07adef48-bd50-532c-a3d7-072de66a903e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:bafbe42c-9111-5eb8-9d0f-ad52e581277b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:07107775-8f2c-5b27-8177-b7bf6a27025e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d0ee2c00-8745-5ece-a2ee-6dabe65f1166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5dd7be10-bb37-5188-8e61-c069b58080ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:64f43120-a69e-5f53-996a-a4edd5d8a812", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:40604c26-38e8-53a0-9b94-cc7e76a4927f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.10" } ] }