{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2dad9379-a256-5805-87e3-f5fab45d4b33", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8e90fa61-2468-511c-8465-7be75bfa8dd0", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:37ee082d-8846-5495-8b1a-b5d0a6e20561", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5b78592e-4bef-52e8-8336-bb9f878d1efb", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:71cfbc7e-3e1c-5879-b9df-60ea2e987a42", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e308fe5c-1d8b-5eea-ba7e-127521c5c167", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fdb09bf5-eb5c-5f1b-ba7b-c143f167540f", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:76e8c0d0-43fa-5f89-b5b5-ef0b42d673bd", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:824af499-1a1a-5f5c-8ff0-64334584dc86", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6776bbea-79dc-5a8d-ba72-022d65497caf", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:748c23c2-62f2-5d77-b818-857d06b3756c", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f0e520a6-d791-50da-a60d-4bf72f8ce9c5", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a02d179c-e746-5e95-a973-dcd4538e3f72", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:44f5e7f8-25b0-5858-b6de-22ca9daa83c1", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fc8a05b9-97ae-55b6-a23e-8bdb65d6a78a", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9797e29c-90e6-5062-be8b-a77e2e4a0a14", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43f3069f-8ac1-506c-b942-d879b47f8322", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ff8e3c9f-f01f-5d1c-8279-543e80d63fff", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:37938af0-a198-5293-8d85-f48dcbc38f04", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce25bbf8-01c8-5c1f-8d13-7c54d087eb36", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:87d42cbb-ce5b-5805-b7d9-37770ca0be96", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0db3955a-98f8-57b6-8fd2-9e3bcfa2193e", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d26dd759-32f5-5e92-8934-57aee2421c35", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6ba9d988-cb28-597c-b550-4d7d3b4b6931", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:966fb9f4-7870-5690-8aa8-d96759e0de3d", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:de08ede7-30d5-5097-9629-701a38a738cd", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b80995e0-2b16-5826-aad1-2e8c1e4a32f1", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5337e068-03e0-51d7-80ca-e498c6c5d38a", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:30f22b81-00b9-5861-b7fd-654f4a783a92", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:49022bd8-5d75-56d0-b5e9-fdc949108847", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f69c2eac-48a5-5b9e-9fad-941df77e4390", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4df2769f-e564-5a82-a218-3c9b8963b04c", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1972c2a9-6d6b-5492-97b2-a32fb6e35e50", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e4a354c6-bc24-538c-a2c6-2ebc0e7b431c", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e9bfc01b-8d49-5867-aab5-28071d538a19", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:17fe1e92-d371-5414-9265-fc94fff2ce15", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:45f7dd57-dc5c-5955-93fb-96e348806e72", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8d473ec5-30a2-5842-9134-e4712d4cc8d9", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:39753a8f-c32a-5118-84e0-a15d45fde744", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3e10c2fc-113a-5c4a-8f0f-ab17c3ca19dc", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7d37388f-a310-5b33-b94a-dd796c4d5fe6", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:562c22e6-106d-53aa-a071-613440acaf47", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:15e03770-dfe5-5b03-bd17-b4509124fc73", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b96077bf-cb9e-569a-9b7d-264c6f7208ca", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:52adb0bb-a0a3-5e66-a619-702afe2d0416", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2dfdb1d7-abdd-536a-9c91-a5868f3afe53", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fc35fc8b-902e-50d3-b8d9-b818d2663e02", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.5" } ] }