{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fc846234-e0d4-580b-8ef8-be112f1bca4f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6", "version": "6.1.4-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:323f62c7-7f25-5f2a-9ad1-12aeb6832e5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2009-1190. The vulnerability required Java object deserialization from untrusted remote sources to trigger catastrophic backtracking in JDK <1.6's Pattern.compile. Spring Framework 6.1.4 does not expose Java object deserialization via HTTP endpoints (uses JSON/XML/Protobuf instead), has no RMI or remoting features (removed in Spring 5.3+), and only ...", "justification": "code_not_reachable" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:2665dea9-2e00-5fc1-9162-5c0dc76fb14d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3cd616c7-481b-5e85-9b60-e11e6b18048b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:343fa245-3475-5cf1-881f-5272f884ef45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:0816da1a-af5a-58fc-b5ee-dacae31c5266", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:964297ce-7d18-5080-b2ad-e0a730616f8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:8229792b-ccf4-59ff-b9d1-3c4cfbbd393f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:80debe94-cb40-5949-894d-4c3274ddf3cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:71072496-50f0-52ae-804e-fa168ce48eac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ac99553e-ecc3-5ed7-932e-15ce88166d6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:efe67462-a188-5ae1-9a4d-3fcf25f2fd2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:90c8ff0a-c5f5-50d5-9350-df480f514194", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:80e5419e-1a10-51c8-b8ee-b91f6ef8ddf0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:cafb786e-a5a8-5533-a63e-1faf0ccad7bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:03ad6d8e-32ae-52ff-9658-769d7bd6ca7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:01cb46f8-9f62-5217-9783-47b2cb9551a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:6ab5c2d8-8ffa-577c-8221-2bfd79a7d519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:2b0e34f5-4f97-5729-98c3-bcff30fbded1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e1ccaaa0-f092-5e34-81d5-673ea512f530", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-oxm. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:db9afdec-cba3-5f90-8f0d-f13292040945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:9b24c38c-823c-5d91-b72a-197f5e5b103f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:0c770d98-6a02-5915-a597-7d2dabe2a200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:7efe47bd-c52a-5a0b-aa2f-550140ff4b7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.6 of org.springframework:spring-oxm, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:6327a634-247d-56e2-b5b5-46889d33edd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.6" } ] }