{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9e30a5d1-2d3d-5b1e-a05c-a28de555b316", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a2d31197-585d-591a-a1a3-54bdbe382939", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2bf921b6-94b4-52ed-a434-e0a67b9f5ff2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5917c6ac-36df-5305-92cb-f1f365595540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ded6924c-fddd-58fc-9d46-3f5c54b221db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e3a3157c-c8ae-5580-a7f1-921ddfdc1349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4fbb4441-2a50-511a-8288-edcd443f2867", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8bca95ed-d8ab-51c5-aeb2-4bc169e96f50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1c2c870b-cf1b-5321-95d8-c3b008cfcf03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:52ebae67-8022-582e-a86c-7eb617081eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0713f3e8-51f4-545f-81a5-59f45d11c535", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1a6e866b-ef16-50f7-8ef1-a29671d9b6c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0145d6fa-7e33-583c-82ad-46693b363a6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e416a4ad-edcd-56de-a93a-9273b15f4ac6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7a18af13-71d9-515e-9190-6026679e3373", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:64976a65-f7b2-5c66-9d65-ff446be510a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7517dd5b-b8fb-59ec-bfee-8787c8ae0127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:250cd529-e175-5022-8d00-e8387327a2ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e110eb03-6725-5799-b0bf-ae21dc4be58b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5dd06039-1f79-5d24-b056-8f8d9ba98ab5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:81c7b8b7-4569-537c-8cc1-06ba6e64df01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:48b37fa7-0337-5830-b297-1d9c6fa86206", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:faa6527a-e749-5c36-a160-2dff7f527180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c3839081-e6db-5c27-af2d-413a5679a689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:98c5ed95-1051-5b95-923b-cf7c1d93e4a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:af8cdb47-1760-5f50-bc24-3b685aecc96e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ac932b5f-63b5-5145-a5a8-c2160284d251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:71941b1c-67de-576d-a105-6431295003a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:003f43ab-3366-57f1-9e92-a7a7bb425e7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0784f1e7-18d4-53cd-a4a9-81adfacf42cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2a6584bb-2a4e-5161-9211-61095a689947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:91e4270e-b8d0-5555-822f-3f5cabed495b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b4c64541-c1e4-5bce-885b-3b6591036629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:02932fed-cad6-5cfe-88b8-4d8edcc9d84b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9a8ffc90-b9fa-5a2d-9769-e03b1c8f71d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1e98347d-9008-5d9d-9527-0c53a4709f5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ] }