{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f39fedda-3e7c-5bfa-9957-5a3e4d4b7848", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:869d46b5-c983-59d2-9f34-454bd5abba1c", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:938eb56c-3238-559a-974b-0bfc086dd78a", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:db41d6fa-baa6-5552-876b-3adddb60ccf8", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d584bae2-e500-5249-acc7-a0b737025dc4", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b2d88b03-79df-5447-ac7e-3fc93dd95b73", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b7b80d18-1058-5820-8d1f-28c1bb292bee", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c9865b28-9dd0-5909-a00a-a5680899b443", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f7b5de77-bcaa-5ec6-8dce-efb92ed9cd80", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9b64a4d8-40d7-55f4-b5c8-0f563699dc69", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7f9d2f42-be18-5d03-adde-fee0c8acd2a8", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2d42040c-eff8-5c03-a01c-d6243401d723", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d4d7489f-2935-5764-bb22-64843b7b1c44", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:01c3fea3-66ed-5294-923c-d61fab44f6aa", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9534064e-9217-5f2e-ba55-3f3e5488111c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0d0cd194-9ae5-5c18-9270-9fc9b19b2a3d", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5abedd83-9552-58ca-932f-51d0a4aa74e6", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cc6cfba6-6d74-5f37-b17e-3cc2edd4f37c", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:77cd8685-91cf-508a-96ec-40ef0db951c8", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e27a6f7a-00ef-5380-a9b4-f5028b4aa3a5", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c408045f-2577-563a-9eb6-d0fed9f2771e", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0b300a3d-3c74-5334-aef1-93d4a1d79265", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:39769afe-b47a-5db3-b416-c3fc26cb3977", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6607aef9-0bd7-59f0-b166-fc4759645002", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:390d9f0e-646a-5383-ba64-e3579d2ae232", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3808bc4a-ee79-5cd9-bc4c-f98fc368bbc7", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6005caff-2f1f-5bfc-8133-1fbe308b7fec", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cdf57a54-a00d-5880-a285-00be804e65f8", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2f8fdbec-1a64-51d4-a9de-457fe205a71c", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:28e0cd05-1641-5335-88db-a2b6ddcddb28", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8e2a2922-e904-5a41-bf4c-5dad232cfc0f", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1f29a0c8-2b30-5b49-b328-e4f8e9350443", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:81a7fa2d-a3aa-5402-86fb-cda5bd2ec54e", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8f2821ae-b28e-5a3b-aa9b-38ffb82d9554", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2ba6d3d5-d0d8-5138-85be-6a855aa53b04", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:403c1bf0-58b9-5cce-874e-6d5be5950a01", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a8fb9c3a-078b-5cbc-8f9c-b02b3c7fdae9", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce5e0576-c670-5bb1-83ce-a9983e3be266", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:62728e5e-5a0e-51d9-b9b8-7efa118671c7", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:55d76eca-a11f-5f44-a897-72a2306aa886", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b12bdf4f-7f62-5a1c-b774-3fec42d3deff", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a1b0b310-b3a8-508c-9c25-4307640bf600", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4b19ff19-a4e6-5634-ad2e-008e3a4acdab", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e3cd67cd-dda1-53d4-9193-a0f31bfb17a9", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:41b35f90-eef9-5654-ab43-2548f3e86b66", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b84f58c-9d33-5d63-bad0-7a091751625d", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:179947c8-94e6-55e2-96ce-6800492dfde3", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.5" } ] }