{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7113fb45-144d-5dee-8323-f5a7be6ec793", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1", "version": "5.1.13.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:023cc614-7421-5e70-aeff-7edeb6267aa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2d851af-7a92-510c-a131-220aa9826671", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1fa8a926-56fd-5d8c-a940-376edfba4fb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ab324e5-2193-5bb9-9aa0-d02ac4a719e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0bf411c5-ed87-5238-97de-ad0f939a1a78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0dcb93da-6a6f-585c-b3a0-c0a075d64068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e6fc72e-e0fa-5318-9c0b-5c8f69206914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b50bb07c-d2e4-5ba3-922c-167c6153b371", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b89bdde-8fc7-587e-a22f-a38350027149", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0b21aa5c-9db3-5f05-9ae6-e1684176c2bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1cdef389-1e1f-508f-8349-71ab5bd116af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4cae26d3-02c4-5a89-9df0-13a4601e349f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:36fb3e4f-0cfc-5782-975b-ba206b162df5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:09b42309-3496-5cc3-bc92-c0984030c9f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2909c88-50c9-5fb4-b5ec-c1ce88e8e61b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9fbc86cd-ed5a-5194-a464-49ddf836d0ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:77ba4116-1a61-5195-a8b3-6ccc128ce88a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9e3b53ed-12ba-5406-948e-c870c906a264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49ee28be-8ce9-51f2-b8bc-bbc5832f9632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7877e9a5-6ca2-593b-81b1-d68de5eba2bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0e84e62f-d1a8-53c1-837b-dd1f72e7980b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8cc0398-efa4-5543-ae06-7d2e47218406", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3a528936-ffa1-5443-a5b2-0b517be7f554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c28a0a51-abe7-5b66-bac8-1103d83dcf51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d2b566ce-d273-589c-ad13-4425d748d7ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 The target version 5.1.13.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() vulnerability introduced by the CVE-2022-22968 fix, which made disallowedFields matching case-insensitive. However, version 5.1.13.RELEASE predates CVE-2022-22968 and uses case-SENSITIVE field matching without any toLowerCase() calls. The vulnerable code pattern (locale-depen...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:06979444-7e47-521f-b913-24df5929c872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3201bef5-9063-58f7-a9b8-b57cf9e215bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1821922b-e4f1-5a8c-b6ff-06a4e9a1af98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:90c5b8ad-de51-53cb-9366-02ba6b21fb55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c638b225-4ac1-5543-b088-5bdb40baaa21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7f160fc0-5a2f-5485-8adf-8c1f6afd4a67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33238528-d645-5dcf-bdc9-c26703226385", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:464fb0f0-f76c-5174-a839-388caa86c856", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:76cbc72c-e1dc-513d-b76e-3764fd52afd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3026003e-e30a-5a04-b73b-2088ec0750b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.13.RELEASE-tuxcare.1" } ] }