{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f08884c6-2d2b-5ff0-9357-b3d38ca1059e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1", "version": "5.1.13.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1c2e9d20-cd31-580f-b7ef-8de738cabcb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2009-1190. The vulnerability requires Sun JDK before 1.6 (with algorithmic complexity issues in Pattern.compile), but Spring 5.1.13 requires JDK 8+ as confirmed in documentation and build configuration. The underlying JDK vulnerability was fixed in JDK 1.6 (2006), 14 years before Spring 5.1 was released. While Spring 5.1.13 still contains P...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a79e7b32-cfaa-5b22-b46d-f8f007875fbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05693d59-6252-5406-a800-990a1f78bcc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7338ed7-32f9-5dd9-85ee-31122bf5fed7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:efe38b90-8f07-504d-b2f2-5d1ff2dbe636", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:651c5827-ab76-5e24-8cff-6cc1cfc311a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d04ab07a-616b-59d0-9182-8851bc43f2c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5945e046-cafa-5290-be6b-5c3d8a46f324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1e05ac8-54dc-5f07-b760-4d30783c4f64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:403b9dc8-a8e9-51c9-b7ed-a842373620e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7c6e8f67-3cfa-562e-870b-deb5a5efeaf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ce1f7f94-fc43-5576-b2fe-c31dc728bae6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7af89822-dbbd-5f40-9575-4f7d4713679e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8bc8f2f9-03fa-500c-9703-e600cada4ede", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:67c662ba-91c4-5d6d-bbad-d2da9c02bb2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:296f3821-fdc9-55fa-bd70-ceb9a8a52c46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7df5a15c-50ae-5812-be72-4c80e6653d69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8efcd173-8497-582a-933b-58df4206436c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63103822-8508-5f11-b7c7-6d4ed9535c43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:162e13cc-2f4c-5e11-8731-23b44754d3e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e8b31f8-4502-55be-b6bc-77fb65ecbf46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c667eb21-e81f-53fb-95e4-a13226ee65a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1ceec565-057d-533a-a280-b1e889b146ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:089221d9-a9ea-5321-b374-0d72b2c7f9bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.1" } ] }