{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:46b2d7f6-c12a-56ff-aacf-192383db052f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10", "version": "4.3.30.RELEASE-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.30.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:168a440f-cd38-5d09-8e8a-f9cc205a0dc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:77a47e37-3b52-5729-ad8e-d42784d7dc12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7df9e2f0-d6a0-5f20-81d6-6cee17f7d819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:027932a1-1006-5e27-b608-657630c7dda2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:4168a2ae-3963-5e1c-98f8-a72bece6fe61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:4fdc3385-ab80-51f7-956d-8c247fc732fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6982c8ac-dfc3-5109-abf9-f86fbf9ff96d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:88e86be9-52b9-5db1-b5d1-6057c13a1dfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:4ec0c6a6-3f3b-5df5-a789-d4ffee8f9599", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e21730db-d046-5511-b557-5c380ad78ce7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2018-1257 fix is present in target version 4.3.30.RELEASE. The vulnerability allowed ReDoS attacks via malicious selector expressions in STOMP WebSocket subscriptions. The upstream fix (commit 246a6db1ca by Rossen Stoyanchev, April 17, 2018) made the selector header configurable and allows disabling it by setting selectorHeaderName to null. This fix was already included in Spring Framework ...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b2610667-4b72-51d8-83c6-81a8eebf94e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fcf45d1c-47dc-52c0-bb9c-4abac7b85f31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c64d7a70-0612-5d17-bc02-711d9ea3fd82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0019dfb8-ad87-5b20-8d61-c6cb43be26c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:61ad4d8f-4915-5555-b60b-4c9b072bea97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b94399c4-b051-5496-9818-e44e41a8db28", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7dd4518b-72f1-5a57-9c2f-4302fee6ca4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:9f4587f4-1feb-50b1-af10-b2926e520f2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fb39d4eb-4953-5353-a8af-475d7b953317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:8cee5952-b371-5735-814e-b586bc58d1e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ee7d5d9e-f649-5a17-8001-6b75c2f8f198", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:832788e7-d47f-5acb-bb2b-a623aecef5f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:01fb3ae4-7020-569c-9815-6b7d7a7e6454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.30.RELEASE-tuxcare.10" } ] }