{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:25ff0167-f3cd-5338-809d-0d03a157e935", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e8c33d31-87bb-5a19-9e67-a328ed78f161", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2009-1190. While the code pattern (serializable JdkRegexpMethodPointcut calling Pattern.compile without validation) exists in the codebase, the underlying JDK vulnerability (algorithmic complexity in Pattern.compile) was fixed by Oracle/Sun in JDK 1.6. Spring Framework 6.0.23 requires JDK 17 as its minimum runtime, making it impossible to deploy on...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:014a7b19-ef11-54c8-aa5f-4e0ea215205f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a1291f18-86e9-5e98-8082-01cc09c3245d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:08231cfd-8627-5458-8883-fcd1cd1855fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7031944d-e2e4-5c3d-bd44-d806c403baed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c9aa4c2c-9e40-5c17-a623-a6e64164a0e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8451bad1-d00b-5cf5-bbde-36c22af1fc90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:3323efec-df57-5f31-99b9-71deaab5f234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e6a423d7-3d6a-5787-b6b1-a0e64937bed2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d9e26462-6434-5b31-a021-069472227b95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:26e2ce6c-f9a5-57af-ae40-9b3667757154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7ce8123b-73ba-5ebb-8b20-8def1f50c6b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e23c0893-6ede-50c6-9d45-4eac8c1ebeba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:cfce0ef6-ee85-5473-b331-3931cc1d3807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:9ef299f2-bb11-5295-b1a0-3852743c6c7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1b7a7f0f-7241-585b-b3da-4eb96814588e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:391fcb3c-b4b4-50e5-a2e8-1632bd3abd11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d7362d78-2dc9-5148-a741-4c7ea542c348", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:349a9fb4-1370-51e9-8b88-1740c556098f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-oxm. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:49e7c718-532f-52ff-a7bd-64284429361d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b74ded21-1160-5275-9562-cd6386adde05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c5f19968-591e-5a89-915b-b7140271b059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f8bff03f-2e6f-5e9c-9f39-cd2f5f7a2b2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-oxm, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:bb58b85f-fba1-52b6-b577-838d0d5009bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.10" } ] }