{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fcc715d3-1b15-5c2b-aace-741674473218", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5", "version": "4.3.9.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:067d561e-5bbf-54e3-a207-bc7b00c74374", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f3f45b14-00b2-58b6-b5b8-1a8aedb45b48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1844681d-199d-5df4-b95a-e1439d1f2c38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8de0b23c-9678-5967-a572-b37a975490c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:19e4e430-4351-5acf-87b3-c126dbd9dcde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a27e6575-a1ff-589d-8585-1ae280138c07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ce36a92a-e4a6-5dde-8568-25641a691a9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a9814c65-e9eb-5393-880f-e303d003d8d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:49879851-ea41-5ebb-aa28-6eac5b984aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:85361d21-90d1-5c20-b84e-8833af863b3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8a262fd7-4c9e-513d-92b4-1538d12ffc39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e08d860b-da93-5071-903d-0ec5426c19db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:20b5948f-b6b1-5251-bc2f-411ff3dbb412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0f84799f-75fc-5837-8a93-5ba20e300a73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8700b1b5-ce05-59e3-893a-a5b7dcacf5e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:39bcd9fb-1fc8-519e-917e-0ef0101f0d34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1f67153c-02ae-56a5-a2b3-5bd6c23604b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d2dac007-2c6b-53d8-b957-097aad4cd60d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e08a4444-a3cf-5d6a-9f5a-ec54a4a19ef7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fa28fcec-2aeb-5e4a-a466-ef39725cddea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a2b2a0cd-a4de-5eac-9a8c-f8ac913b0712", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9716386c-cd48-5dcb-b5bb-8f5268e117d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d6a24498-7944-5801-adf6-6311bc971081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:86e6df5c-25d1-5f3e-9c46-35d9d1148748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:68d29697-281a-5da2-bda9-c635bdb56be5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2024-38820. This version does not contain the CVE-2022-22968 fix that introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields mechanism, so the specific locale-dependent case conversion vulnerability that CVE-2024-38820 addresses is not present. However, 4.3.9 is vulnerable to the predecessor vulnerability CVE-2022-2...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:53a00bfb-791d-5d1d-a8d2-f48913f0d7bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bdaaef33-816a-5ff4-a24d-8e5c2c3c46b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:998fa823-f724-55c1-addf-bb0ecc00a43a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bd273230-6950-5320-8d18-cd35d368b302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5f81424c-e060-550c-a289-e0b122a29c36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8f3ea336-c7ea-5f4a-b17d-c56a41d8d65f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d1668f2b-6e80-58fb-98ab-3944e2082973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:67ed6832-f7db-516b-a20f-184d0efac6c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dd396842-3586-58ae-9de5-5136e4157fd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fc5e296b-fff6-5c01-9af5-4de26aaf6cf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE-tuxcare.5" } ] }