{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cf9c089e-454b-52eb-93d8-1d08763a1475", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-context", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:15387ad5-3adc-5e4a-95da-503548ed9504", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:158a7c9d-f815-5c8c-a177-5234add5f161", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7cd60d73-3102-5a1d-afe3-e62e6adb4531", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1025679a-c986-55ca-932d-c4753e72fb1c", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ea5f983a-2f21-5696-a133-7db7d7f2ec4d", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:89147fd7-516e-53f9-91be-028cb10db236", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8921cc0a-5a6e-5059-b770-2692015ddb2e", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:001523ee-1d7f-5941-b152-4cf142857d08", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:32f85339-0791-5dbd-a2a5-d257c804e42c", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:68f1ac48-d2ab-54ac-9f01-0496baa8ce21", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7529c8b7-e132-5286-8e00-914346157d96", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:790ed8f7-d827-5ae7-8cec-e99638deb63b", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1c1e5439-ac91-5826-8192-fb56ef2be4bf", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c6e6778e-58b3-5d8e-9a8e-98304ab96b53", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef81becd-8cf4-5c4b-826c-c3003e7129e0", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ab5c1f43-4424-576e-b5c6-a390c4a56d64", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:901c3530-e60f-560f-bf06-894cd74840a9", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4aa0b31f-48ed-5a7b-97aa-e2b93208af2c", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6007395e-bfb5-5d52-9e87-5d440e088a34", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c20f1ecd-38a9-5022-a20d-74a37d382504", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fdff3dff-2599-5f9d-a5bb-168f1da63c75", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:73e0b25e-9fc3-533f-ad74-7ed931eb0a1a", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6666f41b-44ea-50e2-b57a-0beebf682f15", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:18f9851c-b2ad-539d-a1ea-880a40d6fb66", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6a932ec2-cf47-5606-8eec-089a374acb10", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:00401238-2022-5fae-a6f9-5884e7b99595", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6e1d5d58-536b-5480-b0c0-6c4cef347f31", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fb132e71-4cd2-5d3c-846b-f5bf5edb8fa1", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ae331bc8-adfa-5f79-9bc8-5c0c9626a9b9", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f89d475e-5db4-5ca3-8f1d-9442ef28c50a", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dadb4b44-577e-530a-aeef-59213baae019", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7166a6cd-89fa-5887-bad1-0484d19b1374", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4aea0b2a-5b6f-54d5-9d83-d4eceb738130", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c5996ef1-6172-5415-9792-06909f46d8fb", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:541e2424-a822-50e4-b560-2977b1441b10", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a5f783aa-ad96-5750-af1d-657c1a43ee24", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ea2f7781-dbef-5a3e-8a0e-0f225824a024", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2c37afc8-a7d3-5d01-b401-eb64a9f8892d", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f7c74a16-921b-5bd7-8f03-3f3a666ddcac", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:767a02ed-e96a-5ea8-a31c-ed3874b5b860", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f2596989-7a0c-5c68-b929-1cde70f5d056", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e9924b62-c3b8-5ac3-9cdf-c0fb30416882", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd20de04-98f8-5b30-b8a2-a8d1fac989f3", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:13581bd2-6abd-55c5-98a2-6c8d83b4e6c3", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4ac17d29-bf40-552b-a54f-097eab5a6b4a", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e4339e74-913b-50fb-b45f-a99bbeea40c3", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.6" } ] }