{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e2031a6d-7064-5958-b6c8-eebc887ded00", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12", "version": "5.3.29-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:61abf9b0-5c1b-5be5-91e9-bd5561511fbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:ad79b489-d11f-5ebc-86c9-4dd8d8e82ced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:b5d0142b-a2cd-54d1-b943-9b43a666dcd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:d3276654-3d62-5d14-a3d9-286aa2ce4c12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:c51e6220-0c03-50bc-89a3-afb017dd5971", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:cd8632bc-36fb-5c34-96e4-d4c5e4476f2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:983b09d2-035c-5324-bcdd-4a822295656a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:e73c8a13-a484-5236-a899-7d8aae40b59d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:b630c20a-4b55-53d4-8429-b8442207cac3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:0bec7861-03a5-5997-b394-ed32257fa07d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:4eb45eec-9815-59be-8183-b8d58fb66a6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:5490e650-7db2-56ff-aaac-fafcaab4a447", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:dad17677-a929-5014-81fc-35c9be17e4f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:f15666e9-9cfd-5a62-b3d1-d4e871688100", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:03f70e5d-e6d6-589c-9c69-62df3d886e24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:725727b7-e71f-5ef5-9ea8-54ef5b09f91a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:4e47e05a-c048-53fc-aa80-300971d09c8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:068a89b2-bf65-54e1-99ea-073e441db5b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:012f8f4c-fd5b-5e87-8113-4b07bdfab8ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-oxm. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:3a9a9e8e-b929-539f-a584-bc1b3151437d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:79fb595c-1017-5bfa-8c12-e8df1bbf4eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:0450044a-0fb6-5415-b75c-9a43b397752d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:31d6f29b-6f77-5dd5-a0d7-a84192a25b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:38a174eb-41c1-5600-aff2-1667e3062199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.12" } ] }