{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dff67a71-c493-5775-a9ea-70feceb85c5e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f2a6bf71-5ab1-53bc-8892-107259153d11", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3d3c9580-db3a-5664-b009-9815ca96874f", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:96934c08-bb74-5d7b-ba81-a1b8891b1eb0", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:caf3b0c3-85bc-5a69-85b8-03475b12e481", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:63fac9bf-bdbf-5522-b517-898f7f58a6c4", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:dff2f286-f784-5fcc-903b-4a3dae8a463c", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:620f6151-81ba-57f6-a5b0-82648489cb13", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:47c80cd2-817d-5b9d-94b9-d34b851de12f", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d8ef7e57-a2cd-5751-893f-7714f5c13b4f", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8629a33f-a483-55b2-9d24-90805851875f", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c6a7776f-d466-5a69-b490-510b6d2a5ea7", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1c008402-6db1-5fd3-a0ce-6dd80f81f4f8", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7309b8d8-4464-518f-bc17-d7283b653e74", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a661309d-707c-54ac-b736-53f5052dde1d", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b545d1a1-fd6b-59bb-99b5-52ee8cebfc02", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:17378333-e07a-5c62-998f-4d0a08537639", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:420e463c-2cae-5114-b458-43208de17507", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:34928a30-8baf-5298-b800-9e68f7485ec0", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:10caeee7-e8ca-527d-95fc-1407acf9473f", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3ec12013-6276-5b3f-add5-a3ce10d69169", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:67624dc1-f6c2-5083-a26e-eca1e2c9c522", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:dfebe645-0dde-5da0-aa44-79748037f20f", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:28bd2a9b-ad3a-58de-8f92-7b6769f28523", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a3aff5ef-a230-5f31-822d-6647f2e96b6b", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:58fc99ac-42a1-580e-a88b-73d242be801f", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fa9fbf6e-0e70-53d8-91bd-409f62fe2813", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2d89eaef-1722-5607-8d4f-fbc3174ea27e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ac329a6d-ffc9-593a-814f-88eea3dd2bd7", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6f8a9f30-1bc5-5e68-b894-fc293d7adc6e", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7d802e23-24e3-5192-b681-1a8f1b70c8b1", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5997cf4b-8614-5738-b249-1d20e9e4a0f1", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c044c533-5f95-5be9-916b-c4334856c3f1", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:310de533-d939-56b4-a8b7-8981388c903c", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bf65b8c4-8272-5146-b3e9-707a8444ac21", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:54a718b8-17b0-5ffe-b4e1-72243a83efea", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e996a808-969b-52df-b4b7-a5b56951f56c", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:244e07d8-02b6-528c-937b-09a64c56dfda", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0fde54e0-ba03-5323-9810-d52bf0f64c5a", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:37947330-b768-5c75-972c-4f2ecdc9bda5", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a05981bf-f423-5abb-89af-5b9b42367fd8", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:78cabc3e-05d3-5ac9-be1e-c7f75b8c0319", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:55556e1a-1f0e-51bd-8983-b86c9638f926", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:35c0d12d-bd17-508b-867c-b45c0fe82435", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0bb033fe-eb44-5b03-8220-8123f55f420b", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4988a09a-bcbd-5003-90b3-631b499a964a", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bfca95c0-af70-5f01-9124-df134e749f64", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.7" } ] }