{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c3e5432e-f26b-5f29-8288-7861eada6bcb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5", "version": "4.3.4.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f7ebde78-2db5-59cc-8287-623adaf6b8f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2f1fe22b-8a9d-5de2-8246-52dadbabbacc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1caf6847-5be7-51c3-a546-f1d5c9067536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:28ff8ba3-f87d-5ef8-9087-54118ac2996a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:170c6bf5-19d1-5a59-922b-bc9a58f1c178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6c07884e-909e-5676-810e-3f8036bed3f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:557bd2e4-7ed6-5dec-a342-eae9293b6ca9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:73f5238d-c2c7-5b62-8d51-ef0fbefed631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9322e5d1-6606-51ec-b40e-d6745c162bc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:53e20fb4-3f8e-50ac-8e95-4d202942ea28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9ea0adfc-342b-5c20-a483-6b41c9ecd9fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4ac6e2be-34ed-5c25-a2da-573034c2d7f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4e8f8e36-3ad0-5664-b347-ba7d49ec2d10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:70c5a366-c4cf-5b34-887e-c195837cf1c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:465a3c15-485c-5224-8ed1-3cdfec9905c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:124d5d33-e14d-574a-83d8-cd88746cf4de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4d06dfbe-17d4-50a2-8aa1-998324b0900b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c0c79158-1390-5d9e-80d2-b503f8af0444", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1a847895-f2da-592f-9b3a-128f466b05e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dad648b5-0083-576e-869f-0cc9d65a6053", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:12c2e4c2-ecd2-5775-b92c-bf330d4f63d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2db61b74-7bb7-5ade-9054-e78a790eec7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:60d3ded4-1290-5dba-9dd6-a51c5ba630b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e86ba0cf-a307-52a2-9d07-750e0300722f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:51d7af00-d428-5e7b-8d22-2b4b317fdb0c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7b33f48f-8e09-5124-acb8-f6ac1c33d8fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:47fe949d-c01e-5016-947f-fc8603c3c850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:384f7e34-6b8c-566e-a2cf-41edf7f2d041", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2628409b-da6a-599d-9715-c518f5353127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:53a3436f-afaf-52f0-8b8f-d8cca78058c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b472464c-9531-5e26-bf41-660b8fd13611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b701c60d-b863-50a7-a57e-7d2ebb100c4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:15ea8846-18d0-5613-a0a4-6748a2a9e1c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3850b09d-3d3b-53e4-94a8-cc40b3b22eab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5979d918-e9d8-5a17-b485-1119e53820d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f2609a3b-3be8-512b-9487-573000756a45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-context, and is fixed in 4.3.4.RELEASE-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.4.RELEASE-tuxcare.5" } ] }