{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0650af9f-309f-50c8-9f16-180894f1ac29", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:407e892a-73da-5518-89e4-3d48df7437fc", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8555e7fd-3bf5-5e0a-9d1f-03bbb89dc972", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3c133a92-d9c7-553e-9682-52a67d69da8d", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:14320c5f-f7c4-5f9c-9af4-f58533173eba", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e8055c80-dc2b-51e0-aa9f-776addae9ad3", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d8d47210-6512-5c79-89eb-ed995882d830", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:83f57348-64a9-5f8c-aa03-348d94e4a94e", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9193ef7f-d2a9-5182-a904-58212a662d3f", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a9a1b60d-6ef5-565e-b2f0-d9d3d43c9a4d", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d695fed0-4653-530f-b04d-8a1cde4ce4de", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:05b3838e-5e48-5e02-b695-399fbf03569e", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e24977cb-fc4f-56a6-9a98-290e803f09b1", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0a7f5acc-5136-5f84-9033-5ecb5e3eccae", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4cb50de4-f6b0-5d64-9ffb-e7357f72162c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c232847b-a410-59d0-bc10-de297b2171ec", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:664628a7-9f79-5b1a-ac46-839974ab447d", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ab15028e-428d-5c8c-b53e-4e3bf8e51fb2", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8c6ab854-a496-53bd-948c-30b543236b4f", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9409c871-9d43-5483-942f-2dfdf8178f52", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8d90c4c5-173d-5a51-abe3-1143040969bf", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2b88d079-f230-584d-975a-b3e60f6d0f66", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:df1ec04c-1e89-5c72-b848-314a3e81e208", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b50596bc-fce4-59cf-bb79-fb34bae1347b", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:45e5efad-496d-5a4e-8288-8c8169f6333f", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1f9b7f76-0b1d-5902-be1d-eacc6bf096f1", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fe13ee89-691c-52f2-922f-b525b2201b34", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:39cf567e-17f6-5bb0-9bf4-4de3157b10ca", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:43f1ec05-5003-509b-82a5-7ef5a0304af4", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:707368ba-56b4-56cb-b023-10c5b6fdd055", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:347fcf3f-911b-5bcd-b583-9bb940dfd7a2", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:20b5fc26-500a-5a9b-891e-921c2e037038", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:319aeac0-91aa-516b-9213-329d1d302ea8", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c4cc9598-4cda-582e-b6b3-842a349df97b", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ac4b602a-7116-5371-bc64-861ae4efa008", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6bc6dc4a-60fb-5de1-a36e-e8bb6503aea5", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e8643df1-08af-5a64-939d-0a68f6a09280", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:44c21b6b-45d1-5a31-aa0e-418d55c70a4b", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f0bafa28-0450-5f31-af75-a546bfa2ec5d", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dc2c0dfe-cdb3-5d2d-9db2-9eb93e08d076", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd9039c5-002c-57f4-86d0-2038377888be", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7ed627f0-272f-5511-8095-b8cd2d48f58d", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d01a423d-81c4-5dc1-ade7-2fdc41c241d7", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:87e7c5e7-3110-5e1a-ab54-7738a9d9a3b0", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd9edcd5-4109-543b-9ffb-37b0f1586a96", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1fde9b7b-fdee-553c-82c5-437d704f78b1", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6a45bce8-7c7b-5dc0-84aa-13f46df04adc", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.6" } ] }