{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9724e7ae-2af3-5c7e-8b60-4e01e7a87ff0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-aspects", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d2ebffe3-afb2-594f-bbfc-ff7906e181cd", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4a81fc5d-f56b-57d8-9096-40b3bb660bc6", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:13aa5f37-5e1e-51b6-9c6e-ade3871588f1", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:45b41ddf-e587-56e1-a1d4-c9f803c7a1a7", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bf738324-dcd7-533f-9b11-54274117264e", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d12949d9-4e8d-5c57-a55d-103c976fcfce", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:939718df-6ecf-50ae-b3a6-3f0226b92acc", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8db5a6fe-564f-5cdf-82d4-5f512696dab0", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dca71845-36e8-521e-afe8-39cd31bcb40d", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ade39035-4829-519e-8167-2a0c3ae5db6b", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ee5630ee-821c-5811-9249-7aad574fd7e1", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:63d0080e-8881-5e0b-9f42-a7233142d9ea", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f502a70c-6016-5c42-a6cf-18bbe7813f9e", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c86f78c9-82b8-551c-a504-b1380b915d4c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:53f42ff4-b49a-5c63-b13e-b4980f50eef0", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3d9271a5-071f-58ea-94cd-ce20dcd819e8", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:990bf64e-7963-58b3-a02e-1d323cc580e6", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6c24c5d2-4aac-5e66-9ea3-bd735f322ff8", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:657f9f78-0267-5691-a500-898036cb7d8d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f2122cc5-ab50-55ff-8298-6ed3f7cb977a", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6900542a-dc7e-5cbc-a0ab-ac1272d98237", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:109c67f0-62d2-563a-99a4-1d0cc58c60cf", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3bac2c69-c4bc-5e3f-b66e-01711f502ff3", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:57fdcf57-f0d6-5bc6-9428-cc4fd0216103", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:545c2e54-6107-5b01-abbb-f16e1981a98c", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:08ca6ea4-366a-593e-bd07-c7e1e188a7e4", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9d9a3fbd-5782-57eb-95df-4e894de468af", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:39cbec37-5808-520e-828c-3cba587e90cb", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:06b4fd16-3282-5357-a171-e5e979e8683b", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cf265bc4-deab-510b-863b-0ce9ae25a1f9", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:91d9d505-2520-57c2-8949-0821f3d1d96a", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:78166f93-744d-5cff-87d3-a09fb25fb207", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c4500b39-2e0e-5cd4-81d9-677576067f01", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dac23c77-4631-59db-b834-6d45975cc556", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:774ef2e3-c42b-5458-91cf-53b4f9a60cc4", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ec12cf61-88ec-5c4e-acc7-1813df43a5c7", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ea38044b-c0cc-5ade-9f2f-70f99c2d9d18", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:32ba22c2-ac12-55f0-b2a9-5844627aca84", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:126d778a-35f6-5daa-9987-b2f159aa84e8", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4735205e-8658-5626-9ccd-c69659201762", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8fea814f-a50e-5b98-a76e-e05ee1cfd2e9", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:51641698-82d0-54c3-9755-31b19ffe1dd0", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b81675d7-98c8-5bed-b210-3d0d89d791f6", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0d014d1b-1561-5d15-8b99-ea98700f6107", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d041cc95-0b8e-56c9-b650-55aeede156fb", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:be3bd109-77e7-51e4-b956-5cf596321ab5", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.6" } ] }