{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61514150-9e95-5884-8975-ce5467d2831c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7b6ace91-dc98-504e-955d-0a86cc466e29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2009-1190 is a JDK-level algorithmic complexity vulnerability affecting Sun JDK before version 1.6 when used with Spring Framework 1.1.0-2.5.6 or 3.0.0.M1-M2. The target (Spring Framework 4.3.25.RELEASE) requires JDK 8+ per README.md line 43, which is far beyond the vulnerable JDK versions. Additionally, Spring 4.3.25.RELEASE includes upstream protections: the PATTERN_ACCESS_THRESHOLD defen...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bf833cd2-f8f8-5f74-99fc-08b23092bbaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3d3d78ba-0995-59b3-8c8f-a6cb2f226994", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b3eb893b-c0ca-5591-970f-a96abdbe8b7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c9453fd6-1bbc-503b-8e18-841dffb548d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:309a3577-6cb0-5ffa-92fd-d3a80c4b10d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0f4b133e-483c-53ad-8172-7309df7dcc1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:31e981ee-c337-5747-9312-fd2e8cd09c0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1379bf8a-da66-5cbd-bc27-3d4a60752b79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f0ff8000-dc0d-5769-9ff7-d7959d28bf1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:babb7893-842d-5be9-a205-63ab88195165", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8b54e401-2c05-5e82-bbcd-b26134040bd6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9c519b5a-db70-560f-8bf2-27f1196b5d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0b5d3160-f182-514d-8c30-d01b6d41251a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:017482f6-ab47-5ddc-8ec6-5a52c22cc750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4bdab675-53e5-5b79-bc0a-76a63586283c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c6957a8b-ed7e-55e0-8f08-9bf09e086286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ef41c633-38a5-5a9a-b512-cae7e37e5222", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fad1674b-dfb9-582a-ba4b-be1e7a531191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e253150c-4f55-5aa1-a2c5-524d370c3873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1ee2dd13-ec98-5906-940b-bdb9dfd84ff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:21a128bf-8254-575d-9804-c93ad5a27e0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4324e574-723f-5feb-b7f1-d038a2181e1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3b861dcb-0452-57a8-98e1-5b8f36f25c90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c4acda5c-09e9-5f95-acc9-7983fd91c57d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.25.RELEASE-tuxcare.6" } ] }