{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c36b1d9d-c6f8-562c-9716-333acf7792a7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1", "version": "5.0.19.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.19.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:766d6a5d-026e-5c88-9eb4-c952eb5f4406", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eb05765a-5b7d-5cbc-aa1f-6d78172ca027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:28eb7a86-c882-5758-826d-57b442f65744", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:413283e4-3f71-52a3-b974-0d03c1e9557d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6563f2ae-d836-5d91-aae4-089b059cce45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5be95cc1-8c41-5d2f-9f5c-9be1edc4b14d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e0a3c253-3f01-5fce-9434-c2ce6050d985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d068806d-7f59-54a6-ab9c-2eb4e08ea2cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:feb80a9f-dbb4-5e3e-8784-3e2290c6b707", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ae2a71d5-ad81-5d36-a51f-81f2c2c41a9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96998eaa-7d39-5430-ba69-962385c3d349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49d6f4ae-60d2-5229-a8d5-bbf85802b0a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dfc83164-d9e4-5e3e-b7bd-eaab334c3bd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac9f319d-c683-5c2e-9018-10e40a923758", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:28b16105-9646-52fb-a981-f4775800cfdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fe0f8a9e-f8d5-5145-a90b-612e414f81da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6aaed128-0417-5517-975a-d6ae235575a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b79c7be9-82e0-5e82-ad79-53ae6ad0d154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f9aa15a4-38da-575d-8a4d-219f94687377", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c3eb45dc-c898-59ce-bc58-752e58190d66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d63babdc-8756-5a32-a584-53de497e8d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07a160ec-75f1-5007-9624-7b53a196bce1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e02e3fb5-9098-5325-81fa-2f1305b288d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0e03c17f-582b-5057-b5ac-3aafda82c8f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1b702537-bf3a-5637-a487-0ec71addbf59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Target version 5.0.19.RELEASE does not contain the vulnerable code pattern from CVE-2024-38820. The vulnerability requires the presence of CVE-2022-22968 fix (which added case-insensitive field matching via toLowerCase()), but this version never received that fix. The target uses case-sensitive matching for disallowedFields without any toLowerCase() calls, so the locale-dependent toLowerCase() ...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c82ec86c-4d93-506a-a028-e352e0d58510", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38f4c37a-735c-50c1-9ac6-6e976dc498c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5afabe7c-2e8d-509a-a432-d76338bef5b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d64723d9-54e9-5ad6-bcea-b7e3e8ca6953", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7f3343b1-bbc5-5362-8270-0ab8086e51dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ed19bf1c-dfed-5454-bdb6-55f62df585bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0530f1e-bc29-5b75-a32a-3fdfd07d7f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1f95c332-7ee8-5344-a21c-f143119ea72d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d380b501-d130-5e09-ac6e-39197b036001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6aa39860-a4b1-5d73-98b3-dbe6c02c4c20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.1" } ] }