{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:65afdda7-2354-5490-a8a0-7bc5b3c1dd2d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1329b873-0d0f-55b4-a318-01fcd9437720", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a532d573-c321-5add-90d0-becd27743840", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:527a8471-c417-5f2f-8099-345b9ef50399", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bb169b97-c127-55ed-909b-d6a5906690c5", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6dd0b488-f775-5488-8588-96d3ba30be67", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1ce833c1-6822-5bd7-b3d2-e766d9ef9174", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f51edac9-c50f-5726-b59d-019db2ce5842", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2ca521ee-af52-5e86-8c24-dd510c695744", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1c028bc6-7e6f-523d-9d94-350de8756154", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a126577a-49de-586b-8f33-b5bf930bcc39", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5da52d9c-8610-50c1-a0b0-4ce5d4728ded", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e4ea9282-f5a9-5197-a140-245eded96bdb", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:81273f2c-3697-5eff-9d61-9b029d0446a2", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:be97ea10-8586-5432-8717-8f8b93c7230c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3005167d-12bb-5153-ae4b-93283eb71fae", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:98aad153-13e8-5408-8ec6-346cd25a1889", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8317610-34fe-5c0a-914c-4d27c2ae8ffc", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ec9f4a7b-573f-533a-8fcf-0753ee377203", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3bd91c6c-ab09-5d93-834e-1b29b265e49f", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:acfa3f58-e703-5f37-b01e-d265a4deea64", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8261c81b-d3c8-59de-a7d9-f6fc48cf3c2c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef96c70e-336e-5274-a528-925a44e6ff22", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:871d1580-4edc-54b9-86c8-668e31360014", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:629576a6-2223-5ed7-855f-4daf35206f57", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1dc09e50-c23a-508a-9d10-13da71b0a4c1", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d7945ae3-01df-5912-a90b-9c48bf2763a7", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a2cf1f96-f546-567d-80e1-1e9752770b0f", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:05cf2ea4-8921-5225-9a67-c860f2d0879c", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5d03cb02-30be-576f-ab33-a7c2bce316b3", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:32b01ca8-2b27-5a27-8cff-ac11e4a32179", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7d1e860f-62f3-54cc-8268-4d40127fdfcb", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0a28f5e5-534a-5517-92e7-ff9d5fd1a2bd", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:423061b7-b2ba-57be-9fdf-de8a4ef74dac", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a626d8fa-9e24-5b8b-a7f7-3658a3fce31f", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:907298f0-41d5-5498-a758-089e59b7d741", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6fdbffc6-3fa8-574a-88e3-56a7ff369071", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4c83849f-8903-5b27-8437-a8843e115494", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a4c19510-0907-558a-bbcb-49f57d9550a3", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:82817e76-e221-56da-b6a8-2844a66fa604", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d8149057-42ee-5ca5-b350-44e35988f081", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9c75be99-9642-54bc-9c26-dfe80c1b605d", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f81b3242-2f9d-5582-ae29-8f7b02403ddf", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e89f3552-f56a-5a57-bab1-2f1e922bfd5a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7f74ea31-e953-5d67-9c9b-79ad24b40cf4", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9b550dcd-0da5-5484-9c48-10b6ae614ea8", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d83ba66c-738e-5087-a305-b77442b611aa", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.6" } ] }