{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:97e72eb6-1c17-5a51-924d-91094f8336d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1", "version": "5.0.0.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:53a32c95-3424-5d18-bc8b-eaf165715dc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cda4975b-286c-5f36-9520-5343b3f02d55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5621f764-f120-5c49-8704-c09b6a1c2998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5e56741a-9375-5d8a-9285-96500629f180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fd799b1a-d9f9-5b97-ae19-ad8154901f83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f799d52d-60d1-55bd-96a2-c19127f66619", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a3bcaec3-9b62-564b-b661-989cf3a52ee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a1e8b3e4-8fc4-5c7d-8820-50e6630b9082", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c329285f-011b-5756-a895-d604ebf0df9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a615e93e-a572-5e86-8d5c-febb79f648c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:76cb1330-f5ff-5cb4-aa85-a8b1f19656c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fbb4eb48-f6a2-5a1e-86b8-37e28072a987", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5dc96987-1695-56a9-a34f-9a9f563f560d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e241577c-03c6-5a69-a180-50a12a16538c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:576c7292-b605-5f7b-add4-33d2f9bc1421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f835d771-038b-56dc-befe-b384be99c412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e46d1a9-ecbf-559d-a739-afba0499fa85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:403cb6d5-87f7-5b69-accd-896642539877", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fbbe48a7-cdf2-5e24-81c4-003839e72c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:676dcbaa-22f0-5f69-b2c6-699331c5b515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87c17ae3-6933-51a2-9ce5-1853ecd10dbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:68327b48-985e-5c7e-86dd-f5859f7bdc21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b6420f68-526f-507f-818d-3634c1ddddb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2c30259-0005-55a6-82f9-a41f019e0703", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5cbc16eb-afbe-5969-b6d2-27b2c3adf151", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Version 5.0.0.RELEASE is not affected by CVE-2024-38820. This vulnerability was introduced by the fix for CVE-2022-22968, which added case-insensitive field matching using toLowerCase() without Locale.ROOT. The target version never received the CVE-2022-22968 fix, so it lacks the vulnerable toLowerCase() calls entirely. The disallowedFields protection in 5.0.0.RELEASE uses case-sensitive matchi...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:020c421b-037a-55c7-8c9f-5a257a9a0985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38b40def-b609-5fa7-a70d-bf56b3363b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ad0da7a4-91bf-5dac-9673-bfd71827cd94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0db1e927-85e7-5194-8bf3-ccd5f75b3780", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:90fd9ea3-d00e-56dd-81ed-d306acb9c92d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a58967d9-cab8-5ca2-b369-5f43504e3f7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5fc625c9-7d46-5350-b2ad-808a59f3ae15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ceccb689-0cca-521f-9c14-2d6cc2de8140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:af484b8e-23e6-5def-adb0-5221e6119a10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:99a9574c-7428-5610-82f5-0b1c68b3725a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59283 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Spring Framework 5.0.0.RELEASE is not affected by CVE-2026-59283. The vulnerability requires the SimpleEvaluationContext class, which was introduced in Spring Framework 4.3.15 (March 2018) and 5.0.5+, after the 5.0.0.RELEASE version (September 2017). Without SimpleEvaluationContext, the attack vector cannot occur. The CVE specifically concerns the SpEL compiler bypassing SimpleEvaluationContext...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.0.RELEASE-tuxcare.1" } ] }