{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cc484e0c-7920-53aa-95fc-daf687e02f0a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-context", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3d791b03-98b6-5bf4-8412-95f6395e4d6b", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3ad79bd3-d8e0-51f3-8b21-f4014bfb9a24", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f3e67159-3b86-5668-8fe1-abf123c87100", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f0445fe5-fe43-53fb-bde4-8b9d0f83d71b", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:313ebf95-a396-5f0c-a941-4318dd98de2c", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4650d74f-b119-56dd-ba11-a81c9e591047", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4aacc4c5-fa1c-57a6-a8b1-e9d8b63e9fbf", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:98c2698a-6596-5253-b166-736a42725b24", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ba2d1419-c18d-5d9f-9644-4128a7199e9a", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f7f11e4f-5cd2-5f5e-be20-be1c92d910af", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b0458842-f588-5497-afca-352c4f5df3c3", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:136ee7c6-ff50-50f0-b3c6-8bbe471efcc6", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8c5f5def-35f6-561c-a9a0-9f4ee3735f7f", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9a720cd5-1db5-50c2-b983-9cdd83bbfcaa", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:805781c8-77b1-56ff-bec7-77ab339b4c6a", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6f404834-074a-5aab-9c81-139985c6fcc5", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:28964ef9-ff8e-54d5-852b-d132eea3baeb", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:42d79c03-9823-556c-b925-07e95f15aaf8", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:254a6cea-fa10-56d7-97b7-8bea8fa0c06c", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:20986b76-587b-5fd0-9270-e18d4b22bfc2", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c692d5a3-2f1b-511e-a82e-121249904d8d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:93aac9da-eaee-506d-8a9d-fca44b15ec78", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:69013db2-0ae7-5348-bbc6-a6ce46fe1d43", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cd165d46-63fa-54d1-93a6-dffdf5f302ac", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c78807a7-0477-56d2-9d48-49982b9df8ca", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:67adba80-f8ae-57ec-93fc-33c130f5f4c3", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a7625979-4abb-5114-a474-7b1e7901a195", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8c30909d-dd3b-53d2-8ff1-d9c07d261110", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:41fa808e-6077-5e34-b64a-49036bb55f55", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fd745317-8226-58c7-bf8f-f7948c88bcc0", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c95115d6-7514-58cd-a97f-328d27debb7c", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1a8a8006-9b7e-5690-91e7-889f2f34ae69", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8a06c555-8d78-5d63-bbde-a163c223df9e", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c081021c-6216-50b0-87da-3666edbd0efb", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e96f5b1f-78c4-507a-990c-9d86e073f1e4", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2497b254-e427-50a7-a31e-cdf15a0d5e67", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bb3acf94-c69d-5cc6-8700-16543415a9ce", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f8c1cb7e-46fa-5b6c-bb63-275cbd6d54c0", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e8788994-28b3-522f-970a-1d34412a4eda", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6b8103d1-98cc-5f05-9097-480b9ea1e89d", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0b977b89-eeda-58d3-9dd9-1cc90f2c1aef", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2704f439-3265-5f1a-8c4f-800c9f360f28", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b2c4aeff-ecf2-5ec6-821f-530f1ae48f08", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c985ce7e-6335-544f-bd48-e3992387a61a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:19c07011-827e-5991-a9f3-9d1cce2000ae", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c0c7cf4f-ce18-54f4-871e-03ef6eb366c8", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.2.9.RELEASE-tuxcare.7" } ] }