{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e4cd9d3e-571d-534d-99f2-bd6e0a3cbd87", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7", "version": "6.1.16-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:08a7f6a3-7aea-52d8-b7c0-698ce75449df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:e308ae14-26ac-5c87-989c-7ed890edc483", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:85371af1-b1e5-5287-be50-a078f32c2205", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:bc44faa6-286e-5991-89a6-86bc4c0dcb88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:657f8fc1-7008-5f7d-9a68-1c3f500823af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:71832dc7-5509-571b-9e9f-af0b4859cbfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:d55b4c9b-b8b5-5c3d-9820-04c6ca37b30e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:080bf19f-9f51-5e26-a7a3-d63f290604cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:c8b573ba-fa25-5bd3-9ea9-5cb11e2af0bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:8dfccbfa-2fe0-5ab3-98e9-bca117ed617d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-tx. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:9375a060-400e-55af-82b3-b313ed192c88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:588b519e-99a3-5539-bd10-1c7a8a8a0933", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:3fdd5a04-336c-5cbf-a103-8cac31e46fc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:284b43ce-54ed-5405-98fe-258c5b033e0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:031eba09-8125-5781-925e-dfe82b5d7528", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:c6b5f802-a3d2-5e2b-abd1-1a1728e7b6e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:31512134-694c-57c0-ba97-713f4a46c1ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-tx. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:15111615-4eb8-5491-bb55-df4c56eb0bf8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-tx. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.1.16. The vulnerability allowed DoS attacks through file upload data binding that triggered repeated property introspection of MultipartFile/Part fields, causing resource exhaustion via unclosed InputStreams. The upstream fix (commit 83186b689f by Juergen Hoeller) blocks introspection of read-only properties returning AutoCloseable types (incl...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:41735190-a74c-5c7a-9eb2-e877b1d6f9c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:80dc97d7-4eeb-5256-a26d-506bc91c6276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:96443a28-3cb6-5d46-a027-cd1ff063fea9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:3ba5ff84-8150-52cc-b52c-a2fa963a499f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.16-tuxcare.7" } ] }