{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ee5eadc5-925c-5dce-a33a-cacf07732a69", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1", "version": "4.3.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e019f793-6466-54d8-aa55-b972a42acaae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:54213756-cc6e-56dc-8ee2-556ec4da1d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f17a784b-8ff6-5aaf-a17b-2f856f72e9d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0000c784-8daf-571d-9911-bfe3668474a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49d9d85c-a2ad-506d-a053-c3c41b6e6618", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aec20ec5-1848-599e-9df8-76f98ecd0748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c68ab3d4-2607-561d-b8d9-c954839c75a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f8f9e5b8-87b0-534c-b1a2-f39272193e36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8dcd954f-152a-5ffb-9c21-dacd7c891a61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f5972429-5d0e-56d3-9882-143c92643ae8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8356f320-6b0c-502f-8512-1315ed3aaac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b0bc80e1-62e0-5079-abd2-ef5c2a1e0b89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b34f7438-8f9c-5d37-8198-df7089e64ff1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8e25af35-69cd-5597-93be-042fdcc103b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33dd638f-d8e8-538f-ab6f-ae18c947b36d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:55a89f33-31df-5728-8b90-7fca517ec4be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e19f3793-b721-50bd-bbe6-83288adc85b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4f112fe9-1773-5f48-80b0-0193597b45a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cd48e87b-d528-5588-aa31-4507e57d665d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:91d9afdd-9e87-57f3-977f-5abbc458a798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cd124cb6-d1e5-5466-bf66-8309f030c321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05ab192d-3853-5b5a-85af-3801f9cb734e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6973dd93-85ce-56fb-b5f1-1be9e4d21cb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5db009a5-2031-58c2-bd34-f8f5acc0a72e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcd5d240-3bf7-5e3b-8d04-3e27641c16ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2024-38820. This CVE is a vulnerability in the fix for CVE-2022-22968, which introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields matching. Version 4.3.5.RELEASE does not have the CVE-2022-22968 fix and therefore lacks the toLowerCase() calls entirely. Since CVE-2024-38820 specifically addresses the locale-depende...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:524f3fcb-d8b0-54b2-abfc-24944a28ee10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:072adf14-cad8-560f-a02c-475c6eb9343f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d47ff0f-cffe-5458-a7cb-ff88d2e7322d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2026-22740. This vulnerability affects WebFlux reactive multipart handling introduced in Spring Framework 5.0. Version 4.3.5.RELEASE predates WebFlux entirely and uses servlet-based multipart handling via Apache Commons FileUpload, which has a completely different architecture without the reactive stream buffer cleanup issue described in the...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9e62cafa-32d4-5b85-a5b9-05335b685dff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9c9affb9-8142-5d62-8f05-fe790223031e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6a27afd7-612d-5ccc-af1a-78780b34aba8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3fa0c2c0-b418-5e8d-9aea-1a41f2a0fd33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:653d43af-977b-5081-a0b5-c887e51f689e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0f6eb2cf-4c3c-5e7e-9c56-962787d8c5d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d6a265e8-2b38-5f1f-82e5-875954ffeac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:666ec319-98f1-5377-971e-dadfbb76d7a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.5.RELEASE-tuxcare.1" } ] }