{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c7814852-7fca-50e4-ac53-bed4e1d7e633", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-aspects", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6bcb7d70-c2e6-5c2f-b112-474a6e4b245e", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b612fe62-f232-5786-bc65-7ac1b543ed1a", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f1641e5f-9d76-578e-a0a4-3c4271bf05ab", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cb4c8ce0-6f56-5858-970a-a3e8e68f65e5", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ad68bd03-59bc-526e-9a78-9b4c75512d18", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:11a37d32-b23f-58a9-b961-99d35c09992f", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4aeb7727-30a4-5f09-9e84-92e5015f690b", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:692f5ccb-f63c-5363-b354-77f58ed2eb73", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43fa5e4d-6c28-56a5-9d2b-4f4d37b7115c", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:58e59548-52cc-5eb6-98ed-df90a2d8df1d", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0f5a3563-58ee-5831-8eb6-c62c7656918f", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:583ed89f-4b4b-5ea2-9d22-09d970b0dcd0", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d231c1cd-92b9-5fcb-99ec-2c2777f4d734", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f2316186-f1a9-528c-b98b-e692cb4808a9", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:19d0dae8-662a-52dc-82c4-196df6bcdfcb", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ed39e7bb-c0ce-5a6c-aae1-1803a3b59ca2", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:63a7df7e-ea53-552a-b725-f10fe324fcd4", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:09590262-63df-5e0b-a5c3-1458520b8907", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8186956d-fb2b-5a26-bd11-4b16b9f37c7c", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:109c985f-7ed3-5d0c-b0be-09d754e5c73d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f2c281fc-e2d2-550b-88ac-5717c63c0b51", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:02f749cb-e29f-59da-b9e9-0ad2263b1fa3", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9f0d1b51-d8b7-517b-a8e0-b1edbc365e38", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c5662238-db00-5f67-a5fd-905c28e90992", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:448825fc-8198-5e57-8c4a-d83d83372027", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ca468cd3-a673-59d8-a1e0-ae85fa4f2f98", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9b50b13e-3739-5959-85de-9826df0da43e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fc0ea21d-ef1c-583d-b9b7-e93a73f7f008", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:76ee3165-0f4b-5198-a686-c13859585d39", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:340b255f-3efd-5d68-8a42-ae125c2b258a", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:73011176-bef5-50c3-ba3b-da2a3a4cdca1", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce8d3bdb-e165-5d5d-8eb5-2f4b1938112b", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4a7f40a1-3587-5738-b728-8c73b7d1203f", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bcfc8f1c-477d-50af-b73a-1c43ce9887df", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a38e2078-39f6-5c65-aabe-4cb0a62a62ea", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0d8f793c-d977-5f64-a26d-da098d63f2ca", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7ebb7258-73b1-5d64-be03-800d5d8e7bf2", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c44f151f-e518-5028-bdca-0962899473b1", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:27ca966d-516c-54cf-b9c6-a262e6fec94e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dbdca5f5-6b60-5cda-bd71-e5fff961a972", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2393d67d-6e20-59c5-99dd-1c61f23379c9", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d76980a5-e000-5bdb-a597-e002be6539e3", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c26f63b-0d52-55b5-b721-4be74540c548", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dc34d707-79b5-5b2d-b6aa-7fb0bea4137f", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f5e564c1-d1fe-5bb6-80b9-4a7ba552b1cf", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fdb996a6-3945-56a3-b0e0-06f6e0d189ee", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.5" } ] }