{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:42ae86cd-d00b-5ec1-bff5-460cea50eb0c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c520859b-c281-57ae-bde3-627c5a3642b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1895a154-2e67-5b54-b9de-e01706f8b7c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8ee4bbf3-1ddc-5fcb-9ccd-dbaf57010b8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0d3f8b79-b646-5c7c-9316-2c864da4814e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6a86db75-c41c-558a-87f9-d3355f956411", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:38d1d386-f9b8-5ebf-8f27-794e89db4270", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e6bab51d-fbdf-524a-a247-e9dcdc52193c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2558abcb-2fbd-58d5-9e4b-aa681a4cce9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f212b5e1-9ad9-5277-a5a3-09c4d796dcf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:31518efc-8e85-559c-8d60-a4c4afa0f621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:164064f8-f586-578b-b4c3-44fc7c379b70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3b0ea06d-a114-515b-bf1a-bbf0f9616eb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5290a2df-a68d-5fd4-ba0e-15f3f950f6f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:928b664d-c52e-5a8e-b03b-111771494baa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3e73aef0-a693-5bd0-a24d-3bf63da06c44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:390acd21-6fe8-5e8e-84a6-60db27fabdab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3281fb98-e89c-5b16-9724-f538565f7568", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a56c3b40-8fca-5377-a91e-4bba56ec3f01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:945e8a83-9e01-5de5-a519-e3e9d782fd29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-oxm. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0355a1a5-994a-5f8d-9826-9149c578c580", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6682bee3-1774-5d14-9da5-a5be99fdf574", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0d1649b4-6577-53d3-b64a-0e6689586b85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:265430e2-1c4a-5055-8b32-b9f03fbf4c1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cf7308c3-7ea6-57f8-9195-1369ac83b854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.12-tuxcare.6" } ] }