{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:898b38b5-3ea8-5db0-b26d-6ae4105ebe90", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "version": "4.1.7.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "4.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c28c9506-8643-5e46-8d96-d3437be8792a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1bdc43b9-9eb1-51ab-89b7-c6a87a2cb928", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:354c94a6-1525-5a02-a8e9-6d11f8bf0183", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:838298d7-d961-5ac9-bc07-fd1eb9367380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7d639c10-fa16-58b1-a928-445a6023bc85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:36c47819-9994-5069-9c72-8b9406cdb2dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4479e988-5943-5222-a450-e0d55a503010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a8605f72-92e7-5e70-aeb8-eb5707b5eb7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:371f4fa2-2100-55d1-86a7-a4f82b80321e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4dcf7cf1-0813-5da4-b33b-a7880235eac9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:df31f2bd-26bc-5291-9618-b8f3ff3ddb26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:9c444812-d074-5f2b-b03e-c89b61fdfa7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7043c651-8cfe-5e19-9b56-1e20bccef069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8dcf00d7-2a1c-5604-82ab-e118a08b88ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5412ca45-2e1e-596c-aa59-93b91e43b78a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2a54e784-68d2-53a3-9db5-038d33b08ce3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:471be5fc-5d39-51f0-ae14-fcb6f1dc8584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c7def8d0-baf2-5a55-9785-0272272672d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7e3db786-08c5-50d1-a32a-6b132b284151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ee80f635-f5e3-5d69-b434-9808a52db7c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:6e9d3abe-646f-50b2-87ae-71878af909d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a8b38b01-9f52-5c7f-a068-4d53c885f61e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e62ce2d7-ed1a-5a0d-95e4-5b406e65f6f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:102a10cc-9c3d-5ddd-b80a-ece82b81b0a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f93173be-fe77-5bd7-8958-fed4876cda8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } ] }