{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f10572ac-bc30-5fa4-b0ea-b1a1bac8dd92", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4b661379-69c8-5ba9-94d3-f3a140acdf7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2009-1190 is a JDK-level algorithmic complexity vulnerability affecting Sun JDK before version 1.6 when used with Spring Framework 1.1.0-2.5.6 or 3.0.0.M1-M2. The target (Spring Framework 4.3.25.RELEASE) requires JDK 8+ per README.md line 43, which is far beyond the vulnerable JDK versions. Additionally, Spring 4.3.25.RELEASE includes upstream protections: the PATTERN_ACCESS_THRESHOLD defen...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:67d5bd0a-28d2-53f2-a3a4-b41fa5481e75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:15611c3b-78ad-5525-ab6b-2c16540a0778", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7ddec584-bc7f-5090-a7e3-ed9effb13198", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9fab705f-37ca-5981-9ace-2098c0589096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:70a305c8-f136-57c8-a48c-3d59433b03ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:11e691f9-e334-58f9-abdc-c74a65d45ab6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:12dabf9a-fd00-5631-a508-73ec9a17ddfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:91e9314c-f778-529d-a2b5-fcf31f835d20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e0aeb03d-7f12-5da2-892c-79defab7ed9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d9d180d1-8761-50ac-80a8-a7d57273d529", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1d18acdf-8694-5096-966c-6067a8a41ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4f6a505a-e550-5b87-831a-27cce9d62abc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:892b86f8-04e3-5647-b34d-10aff830d0f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b367922f-662f-5714-8420-ba7ba0fa1f52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2aa7b690-1d73-5f0d-abeb-2f7628783b7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cdc00013-932d-580f-85b3-b7582916db06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:27dd4c65-1919-5f29-882a-409b1b3c4038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6cd671e9-a827-5e6a-a863-d34b04744622", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bd671b33-1226-5123-82b9-a85290c91b45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2625b417-3576-50d6-b284-ae6f2c55d1a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:635d854c-3155-5c1a-8ac2-fc9de6ce6804", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c555d3fd-28d5-5e2d-b582-4a7cc23bc372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.25.RELEASE-tuxcare.6" } ] }