{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:113cd909-6d69-58c5-8a3d-047d8d379cb9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bb3904ab-f9de-5aec-9e62-2da70be4bd22", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a4c8fb53-3617-5405-8252-2adba3c1bc40", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:103dda4e-7906-5ced-b94e-39a818495d8b", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:19a0fe4e-6801-5dab-8c1f-97c10049c5f5", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f2f15015-6bb3-5b3c-a310-b4129d4bb5ef", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:eb6c263f-4ca0-5cdf-af77-93d0a01dcf6b", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:418f5a22-65b0-5611-8c37-a4cb0fa19948", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:339eaa8b-a54f-5c3c-ae3a-61606c491218", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4341b475-49ee-5be1-a5cd-7191a5eb0eb4", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:686faf94-a08d-5394-9fd5-19388ad06f83", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e608d376-9307-595c-8ad0-6e81f0436f76", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:48bd9439-e80e-58a7-b998-81e02b462007", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e5f70656-5af9-5a84-9d00-a6568a0eeae1", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e2688c07-bd7b-5eab-8b38-82e0c98d5c73", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b233f007-62c4-5d2b-830b-5e3d1456b496", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a3a7a3da-5071-5109-ab6f-b7e7e5a9155f", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:da09d9e2-5fcf-5ea5-9cdf-db6b5bd59c77", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9937476d-8105-510a-941d-04fd657891aa", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7da76281-f351-5062-a122-63d394ed9715", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1c74ff04-2dd7-5dbb-bb82-19933649f3e9", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8e2422bd-5767-5645-8f9d-8454a49aa685", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f479aeb3-7c6f-5e8c-8e8b-d5a6426e7d67", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:053c8cdb-7f79-5ee4-83d4-0fc6ad3220a3", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:40b6f589-9ff4-53c9-b347-e26e476b9c81", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:055cd793-6910-50e4-be38-82af92f7b6a9", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:19177909-3221-5521-a15d-cd664126c5da", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:53ac48f4-ab21-514c-8244-c8d9603a831e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:691f1ad5-ea58-599e-982e-1b60a2209b13", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:609d22c8-ad1d-5f6f-96d5-6723818a10d9", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d456a15a-8b8e-51d8-95a9-2a029f21fed5", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d3489366-4fba-5bea-8f3e-7f0bebcc7822", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3645a386-3ea3-5395-b57d-f98b787e5c0c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c7cb4646-06be-525c-bc0e-89704b72ff91", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e7a4944f-c086-5ec9-9fc0-b4b35baba3d1", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:40f040f2-e539-5816-9760-f4482636160c", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:73f7f4e7-df15-5e41-a59e-818ebafab9fd", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:60a7275d-9190-5935-b98c-4910dcc23cdf", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3a1a6190-9224-537d-b102-d487d608b96e", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:72b11aaa-ecc4-56c4-aff3-bfddfada3cd4", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f9990b48-0c03-520a-859f-160d4cdd9d79", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:59adf2ac-77ab-58d1-a313-635ee8ae0ae8", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:245686a2-bb95-5d32-988b-558f97c682e0", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d0670ece-5fb2-542f-9457-1eaf282deb0b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cdc073db-236b-500b-9c77-55fff03abeaa", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e2e04174-d68a-5f85-8837-fcfae79a5347", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4e1558d3-0cd1-56a8-94f2-14194435849a", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.7" } ] }