{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6d9fb152-175a-5de1-8f2c-478838914127", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fd063c3d-6c85-5bf8-b3f4-3e670d94eb46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2009-1190. While the code pattern (serializable JdkRegexpMethodPointcut calling Pattern.compile without validation) exists in the codebase, the underlying JDK vulnerability (algorithmic complexity in Pattern.compile) was fixed by Oracle/Sun in JDK 1.6. Spring Framework 6.0.23 requires JDK 17 as its minimum runtime, making it impossible to deploy on...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ead1b723-00ab-5692-ac20-ae53a66cad30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9e7e5f57-3ed2-5b59-aa14-f224aef26392", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:575a8f52-5509-5cf7-837e-2ed5558838e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:59ee7548-d2d2-509a-a013-e4d24dcb563d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:19c3d0e1-186d-518a-9dae-665684a423b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:733ada45-c2de-5c90-a08c-4714f9fa6478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f6294cac-1706-5805-adca-ee4b93acfd99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:78d456fc-461f-542d-afb1-bda5e83c448d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5c9e55c7-c86b-54fc-bc8f-df0404f3fd80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d54854f3-caaa-568e-be00-cb34aea30872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a6d000bf-5942-5495-a287-96b955c23f9f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e87e0d50-9e64-5ea0-92eb-8865af86bff9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4fefb833-c585-5a47-acfc-712ae734c352", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9ae19f22-26d7-55fd-9baa-6f72d319d119", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f13a299c-7014-54c2-a022-8820729fb50e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8d85ebbe-b328-5ca0-8859-7c8b5a88a57e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c876c6a0-ab73-5a1b-a869-18c6db6c3f8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:aecdaed4-df61-55da-9eda-3768ed0f8afd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-oxm. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3f811dc2-0771-5c05-8a6d-178ef7f3476e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b763090d-c345-5797-b5f7-14e24f7a52f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0a84a516-3496-5985-ae31-3c7b31928713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:925f382f-8bb1-5e98-aaa5-930d02a44763", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1f3f2d14-837b-5f05-8192-91762eb5e421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ] }