{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c06e18e-9b56-5a02-a9f1-b464bc00ea78", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6e5c827c-01a6-52ab-baa7-40877969a0ac", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:77fc1dda-b0cf-5ba6-9956-6aa42352ed12", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4ac6b697-90e3-5237-b2ed-b1e7c2adfd14", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2629cb2f-7da5-58a5-9a5d-79c13f717072", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:369d98c5-9591-5041-9c92-8cc6b7bc8b7d", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:697420c8-a263-5df7-a403-65431cf86f22", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f693a741-9ff7-5c51-8e1e-975082817904", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:325a046b-2744-5957-9eab-a8243b3c44e4", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2ff53988-0d6e-5020-8bc2-51c4c6800285", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:562996ae-d854-5892-bcc9-00be9770d6c7", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5fe3381a-0487-56c9-b37c-e1f359fa4a3b", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd27bf60-5e60-570b-92ff-0a4182a46707", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:364e62cf-4b5e-5fa1-91d8-277bf3c4a8fa", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fafdf669-4c6d-58a2-a42d-fd31a85169ef", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6fb1b080-a622-5563-9217-b55689e2998d", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5b582cb0-8be7-5e40-ae82-7d7932818269", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:26225a72-5a6f-5c07-9073-c9309e5b50b5", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1197f36a-4710-5acf-9195-86e42a63477b", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2b3d9b95-b19b-5928-99b0-903c73deff86", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4ad7a7d3-f622-5e17-9d98-309965ae4424", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d8d6f9f5-2762-5032-b656-209ed07c4a1c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c01e963a-25e9-5c7f-801c-1d6876410c91", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:90917a30-f82f-56b0-8d5a-021060ff5fbc", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:86947424-434b-5d23-9270-e08a5d29c394", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b2ffdefb-778d-5b77-95fd-fb8190deccdb", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c53e18ca-a33a-5aca-8c93-be87ab5f376c", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1dea2e45-2e52-5758-92ca-c31389726680", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1c02458-088b-58dc-800c-20bb027c6857", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fa881ceb-b0ce-53c1-8954-92613b5dfd34", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:686ddc3d-c41a-5d4c-a5a7-657268da87a7", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:332ccc35-2419-5bae-91bf-afb25ec1a1d5", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dda2102b-4d23-5727-a0f9-1f4960d5a0a3", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4a4a32b4-b6c3-58ef-bbb4-56b8b64cdc14", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:91c8b4f6-1052-5f18-b0e7-9f53b6e5e893", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:64aebe46-c48b-5d83-93c7-7de5af09cb28", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:84d5abfa-c3da-542e-b5f2-bf8c544d595d", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ca68d07c-4886-52f8-b7d0-77cff66061c6", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0d27e9f0-c26f-5d05-9999-786147157583", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0956c19c-c191-5436-ad8e-0e368f640711", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d070fee4-3212-5289-bc6d-640721642356", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1dab1ea-707c-508d-97a6-b26ee54dd6c7", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2ecb0cbf-d70a-574f-8062-2ae97585a4b1", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:05bd25e1-f6ce-5678-bc02-e5be574774d1", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:10afb36f-2fb4-5ccb-9e19-be31b5045bb3", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:df411b36-49b1-585c-b6d6-0dbd7c562147", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:87cfc862-cd65-543a-889d-41290592df0a", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.6" } ] }