{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1e1408ee-a92e-5324-974c-9c34a2a81a5d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e4815c57-e237-5e1d-8592-0ed4a04ba491", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:00a31a76-bb5d-5d8a-8591-02b1efe40c1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6714685d-2b88-536c-922a-0f74a5497ef5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:22c72f24-8078-5f36-a7c5-6173cc3e3f82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e1f848ef-8def-50d4-a8ad-31c9e9684ae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1656782b-8202-5aad-8be6-f20c5e24ef9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fa22c608-9e7c-5bff-b8b9-8fa03ba0433c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:96289e8a-c093-53b6-9acc-764fa4a0a8ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:345c98b5-54cf-57e0-9f4a-bf58a27d8cc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c800b69d-af75-5b2f-934a-74d3d6c1e635", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:26cff4c0-665b-50f3-815b-f5228ecb2843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ba497536-138e-57b6-8623-bfcadd298deb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:39c1b49c-f3ed-5d0b-8a66-3e5862be94fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d958b4f4-bd59-5629-b073-78b90354f09f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:096da9de-da56-5abb-8507-11f88275aace", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dc904ef0-bd53-5dcd-a4d3-3621a529716f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9609aec9-b85a-5d1c-9a19-a86968399996", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:41b7cc01-4169-506d-9a75-5f3ae777b78e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7bd5d8f7-f9a9-597b-984c-788cba9e3abd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ca5fdb16-cd34-58be-a43c-a2497fa9e130", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fe549cc9-005a-55d4-87ae-4704d0e94215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae4ac39d-ed26-5401-b8c3-145072379294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fbdf0ec0-b765-59e3-9164-e6109cb84e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:983c9419-1fea-582a-beb4-9bedf5e24b7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ] }