{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a5bf6a7b-6441-5410-ba09-2c48fda9cf88", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5", "version": "6.0.12-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b956f4be-6af4-544c-ac9d-81db7aefbb7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b78dba13-3475-59d2-9632-83a2704c04b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:f73f5ae5-8d59-531f-a54f-e4e75209ef47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1abbf1f7-ffaf-518a-9ca6-b3dc207d752c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3c3113d5-4285-5eee-9711-7a25d8e75c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:48368be4-2065-5121-9827-862099f7856f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:03aa5a20-6c84-5358-ade8-9f2d9342d0dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ff812db8-8f3c-56d1-b8df-c36601a0aeac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:7f4b2ab7-ee4d-5b2a-b361-a4008b8c8eb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b16cd084-14c7-52ee-8527-443c18826aad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:2c1e6348-3399-5728-8a71-605768f374f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:5b46ddf0-42b5-56c2-b3d9-f8ff7db6c82a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b0c9070c-6ff0-5eb5-b994-be715602563c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6653ee24-ea53-5e71-a4a1-64a4ff035a8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:51a587bc-7c55-59cb-a959-8a4053e4d2c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ee95aa8c-237d-5a3c-ac3f-5676b6852544", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ccdd190d-3976-5d71-9ba4-87be43fd7027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a0f035d6-5892-5cf7-9444-853e679e32c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-context. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1bc5caa9-5c3e-5c3a-9541-c3bfa1475af4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:48ede441-8ec7-52b6-ba88-88a30d28d333", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:36bfafeb-4e84-5ea7-8ba3-c226d5964f9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:61fe90ab-0325-5ed4-b69a-ba39e6c57e7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3feadf6b-1b15-5c4c-8f89-349d2847e292", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:938e7b39-084c-54f5-8ad0-748648c6954c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:da1b282b-9374-5dd3-abb9-9775396a85fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:06678a4e-b732-5f76-a2c6-bf7925fc1190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:43ece22f-93c9-5207-b951-edf75edbcf36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:109b783c-3846-55ff-89bd-13b5817d7abf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:0f780638-f593-568d-bd45-7741733ebf8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1a043953-93d8-59be-93a1-db37d700c835", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c9be1e5f-35d2-523c-9f71-0ae74219b32b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 6.0.12-tuxcare.5 of org.springframework:spring-context, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:51f82e4b-b15f-531c-b460-9868fafd325c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a1a0f92f-7ada-5012-b5e9-9055bb43130d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:185d7374-4fca-5bbf-ad60-ddbc921f4912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:65e1d5eb-cce1-5608-a207-75e29e24ab99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.5" } ] }