{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a954b40e-4371-5604-801b-50016e3118a2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7", "version": "6.1.16-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:f245e03b-bdb9-5434-95c7-1f3909128071", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:f4ba9f4c-6cc1-5969-b2cf-3f20d898671d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:2f6dbf3d-ec8a-5f48-9657-365753e7ef44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:1c21d6bf-c05d-51d0-8efd-61e0a3aa4ac1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:5c0625c5-9017-5ca2-8c31-d68ce647030d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:c3e70af6-d63f-5ca7-9e82-985013b4e934", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:34774612-3552-5cc9-83b1-36a1f8e0e009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:511abda5-a44a-5cec-8bdb-8eb5c8baf63c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:c94635e0-651f-50c7-909f-c2c3f00f5c90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:0cdc5e8a-217c-5f0e-a174-9da5df3ced62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:5c361f24-ec77-56b5-908a-27e8cb3f5898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:4ce62a5a-9e80-5d53-bb02-96f24a13a2f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:778aff1f-6226-5e6b-b816-6022f74edd35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:77ac783d-c97d-570f-896d-0ebf47cbc6bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:0ac66dc8-2d25-556f-a7da-8eb5a3d09042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:3069d4c0-0e48-5688-ad18-bbdc7b89982c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:77b6e1f9-83ab-5431-97d8-53421e4696e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:b51c28c1-5e15-5ee1-a2d0-edb3e6c7ce3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.1.16. The vulnerability allowed DoS attacks through file upload data binding that triggered repeated property introspection of MultipartFile/Part fields, causing resource exhaustion via unclosed InputStreams. The upstream fix (commit 83186b689f by Juergen Hoeller) blocks introspection of read-only properties returning AutoCloseable types (incl...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:c74159aa-ab57-5b59-9c01-0e710c821125", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:362a7a10-7afa-5eba-aa31-e0ffe6e267ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:2bfa84e1-1639-52de-bf26-f9f7fa27b535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:10a46294-3f7f-53ae-90e1-bf84bbb3f8b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.7" } ] }