{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e3e580f-6490-54a5-adf5-946ecf3ee97d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f773a567-582b-5c99-b91c-4a4f08fa046f", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:607fa58e-3dad-5045-8532-fbdce7ca1e7d", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a5d24b02-4b30-505f-9e97-953cda2be7d5", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:97337ca9-6307-511d-970d-b8fe8322c25d", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0db149e0-9cfd-50ee-ac05-7857710bac41", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f6a0e273-b662-5f2e-9a53-a42d02d689e1", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9c2ae5c5-7353-591a-b421-9e48be577751", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bdef1e53-93a6-5e49-9ed7-7b60821f6fb8", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1ad80a7f-69a1-524e-bc1f-558558084d5c", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5e7ed7a8-7dfa-5fe6-96b9-6dc76362bdb5", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a70500b5-cc43-5a6f-80c9-6fdf60f16ca3", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:41222d47-694b-5c79-8100-0f9f8a53a73a", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a619a233-061f-5645-8661-9feea505ab7a", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1be6f544-13fe-5fdb-a856-64e590d3cfd5", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f86655bf-3b9f-5618-9cd6-7ab911c08c95", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fbb7f5ab-2f1c-5458-96e4-661f59e304a1", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:18e3b7f7-1a84-5048-9927-4ebcbd10de41", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7839dcdd-1035-57f2-8dbc-c0413274d6c9", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:82d0507b-7740-5a16-99d2-41303484a672", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:189b0e5c-a2d0-5652-b786-2fc62a876460", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a7d5ca55-5a2d-59c1-a0cc-a8fb67fc723c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8f372da9-b46e-5c41-bde6-66bf9c0a35af", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:03898a84-b63f-5862-b618-459d95e1b739", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b8feab6c-4b14-5128-a28e-a8d0e33edd6e", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:84d6d504-05e2-5c86-b31d-2bafd63100a8", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ccb528ab-c7f6-5316-81b6-8f789bd00d74", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:290f1451-a4f0-5f64-abb0-ed92f78ba8f5", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:080f8155-56ee-5559-935a-d45ab6fdb59e", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:84298350-4e5a-5f99-a085-48cf52889cf2", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:712c21fc-c058-5425-9e64-d98aa80ac52f", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c122774b-ab32-5125-8413-1ab4e250824d", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9db08ca2-621a-5f9f-b0a2-a53b0bff0fbb", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:53f31763-dfbc-514b-af4a-fca8dfee26c8", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:33fb4968-18df-5894-a6fa-1c4fcf285e42", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0457fb29-a6f8-5d6b-a4c1-c516754ead39", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3af06717-e567-5a13-9c4a-6926f9673d34", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:75fe7a0c-433e-51b1-8790-72b1c369942e", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4ea9ead0-9867-523b-97de-ef3c1cd7dda6", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:065b33ae-c6ee-5f14-8ac6-bb6fd007f6cf", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:27571276-7f8b-5082-b6d2-f3a836e8f8ba", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:87c8140d-28a5-55d4-80df-e67959f160a6", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a3c46073-dd43-5389-a00a-a0bc53f2882f", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1c4bd0bd-fbff-5f9d-b7d8-78ddebc64278", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c5fce2d9-5e93-5bb0-a3e7-f4d2a1a73d40", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:922cf81e-e675-5e1a-a0a1-8ca940f44283", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:31ef2feb-d74a-56f1-9ee0-764d720bbfb1", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@4.2.9.RELEASE-tuxcare.7" } ] }