{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2ebda1bd-0412-59c3-a9a0-defc1c43f142", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:60fd8961-c2cb-5f7e-8404-9167ad716ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d9281043-a41b-5e06-a15f-205b4b40ff7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fca0b0ed-5dff-556f-8569-6dbc912ed4e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3fe1fc68-1308-54e4-83f0-3db45b78b02f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:45c105e7-615a-5b0a-bdf8-2c14358207b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:33e9bc14-caf3-55ca-87b6-a760b5309c09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e22697b2-0676-579e-8d28-f1eefb8dbca4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:71355908-e570-5d6e-99b0-4e4865ecadc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8d968fa9-ae8c-50c8-996b-6ec66faa7af0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b8c0f5d8-f8a6-56cb-b1c5-9150aca59005", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c78a74aa-1529-569e-af81-d870a7847420", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bdd66169-46d6-5467-a3a4-375f66190374", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0783f513-15a6-5f9a-b198-29fdb1c9e7d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3b487490-9e0f-571b-8dbc-7f327a3f92be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:42e226eb-a97c-52c5-b8f5-c84edad3d44c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:126c3055-e5aa-5ba3-84e1-da422f200cf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7bedfd68-e04b-5647-b3ee-23d59219c730", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:be2c0ecd-712a-52c1-a50b-e997152bc9c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b1609708-e065-5f4c-9a38-ea754720a368", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e26778f9-8b60-5c60-b769-65be4a92c0a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ce17c95f-f63c-5668-9583-2dd503bee68c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d739358f-6c51-5baa-99c0-bb77828e70e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:39187c4e-bdea-593e-ab2f-27b14732ab64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.25.RELEASE-tuxcare.6" } ] }