{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7bdcdc4e-bf8d-564e-a0f6-7b596cddbe89", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-context", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f0c7e853-18a9-572d-b4fc-5e3d8068d2fb", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:121ffc10-1076-579d-b8a6-d3e487bb7487", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6ae42932-12aa-53e9-a5c3-aa517bcd3738", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f73baafb-4e87-5d66-884a-848f063091c7", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:26aea6a1-affb-51ca-8bf0-d0626e55fe29", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b79e473a-9bd6-507d-a281-3d502a765efa", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c4e3be4a-3ec3-567f-80ce-1a808ab5ad97", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3d2bf98a-8190-5f90-8fb2-ab9a3c1282db", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ddcbf2be-36c3-561d-8b22-9b117ea494e9", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a3416f9f-2557-5e25-8019-a7d0b43e1f4b", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:81c67cc3-195b-5eda-a2b7-8dcd587e48fe", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b79fdf68-05f1-56a3-85cb-4fafbe856aa8", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fa6a5a53-f601-5b1f-a2c2-1d7bb0413d25", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9d602899-389e-597c-97ee-4d5b5701db41", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c01b73da-ed7f-587f-8a8a-52a3dadc8f65", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7882bb20-fb98-5120-89b5-6c2bc6040283", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:38d379e7-65f8-5309-83e0-b18ee8e89af0", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6b67354a-660a-5e9d-9df9-2308b59bea68", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:689218a5-cf6f-5dfc-8d70-44e3dce10de3", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:25424d39-c1d1-567b-89a7-14aa0b90f7c5", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c6dddc31-928b-56ab-ab94-527e688f0fe2", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c62b23e4-d8e1-5597-a59a-0f5c640e18da", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:09881622-8c0c-51e6-9085-b7da0c78c7ec", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e8985a18-15ee-502e-9e74-2ae41d46cb47", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c03b9cc3-3b41-52d6-bf83-c78d343b0821", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a3dc8be7-a175-5c47-b8be-7bfeed4c297b", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9701f4e9-487d-5b47-9d70-0190099f9b45", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fec9fb69-3486-56d3-a3af-796db57ac470", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ac05fc06-3871-5512-8de9-9696c7625183", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9f048c54-7adf-54fd-8ffe-4d6643e2726d", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b7ede640-004a-5f55-9a9c-25ab9fca37a2", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6a4d9826-08c5-5b07-a09f-b6fe76725112", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aba13528-6f9b-56c1-bdc9-54e13c2b0511", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:59f1017b-b877-5574-956a-6b1a4bd66a95", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d9dfc912-3f0a-5139-a6e6-b0d2b6a593eb", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:81ff303a-5413-5ae1-92d9-baf19fef322f", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:09bda293-72aa-57de-97c9-797c3a77aab4", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3d275aff-c89a-59de-ad2a-49fc9f4d95c1", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:209c87c7-c033-5aa2-9f55-c436d59e587c", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fb54894a-bf4f-5f75-90b2-6901877cf9a0", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f72a8808-6eb8-553a-83fd-6a6f69e0f81e", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:acb3c70b-62f4-5d3e-b766-03e67dbf9adf", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:92194c37-a183-5499-b067-60701833e244", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f4c3de40-cb3f-5ff6-ab35-a5cc733ae8b7", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b6744a6-bc91-542a-ac30-7b2e8985dd51", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cdbd1511-690e-5f31-8a0d-f8a9ebfd28a4", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.5" } ] }