{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:48a4afa9-7d7b-583f-a883-c0d633bfd721", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c3b5df77-531b-5124-9d3b-2342bba1c9f9", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:50f55e60-0b64-5656-ba03-cf6c1154a0f2", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:440ce7e5-71fb-53cf-8059-82a7f19a38b2", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9b97cacc-9a64-5636-801f-f752cdfe4aed", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cc8a468b-2c9f-5e3b-afe1-2cc2c04cced4", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:88d822ea-570b-5cec-80dc-044cf56d401e", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:60045ab3-7dae-5bef-97d1-26102007b993", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:93c55130-eaa2-5e71-98e0-156196686a0b", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fc53251d-af2a-5a2e-bf98-a4abb7d89210", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:52d1ac5f-b644-5f22-98f6-65d510dd5312", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f04969ed-49fc-5a7b-9fc9-f84d804f5545", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3a2b9c1d-9ed4-5e52-a5f8-5b0c9880b52b", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2dc7b49b-8aec-5903-85a8-fe9a6bbd4d23", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2908c822-0a6b-58b2-86f0-016774bf228c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ab783e47-4271-534e-a700-fb3e4a0d92ca", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e35dbe09-e9d4-55b4-939b-4217e1fb3379", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e1e9dfa9-e36f-5d01-bb08-6fd32136a8b7", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c4ef834-cdb6-5555-9970-546c346c8251", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7f6d3dd7-65a8-5f01-a9d2-1692fbbac735", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1c4e97ff-613f-5507-8d38-e4568df5ad0d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8381bdda-47b6-5cbc-8f47-2e56a0f64d0d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eede7393-f583-5438-83d0-a9b6d17fb438", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:517cb26a-b5c6-5a76-bae2-1577d6adbcce", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7fdba737-cef3-5c74-87a4-c17da3739004", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:788eb20e-d268-52a4-83fd-36e4732e5a43", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7495ea4e-1242-5243-8422-fb65749ff93d", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f29246bb-363b-5a8a-8962-73760408985d", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:67f7a6c2-0dce-5818-8304-6471f393bf8d", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:638a4141-b8b8-53b7-a4a0-f3d076c38ed5", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:df5a2fe2-e456-5a37-a0da-dd9b7a17fdfb", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1abdc941-df25-5094-9728-d77e52923cb8", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6ee30162-fc5e-5e8e-b463-d0cde7b18de9", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ad32056e-dd06-5ad4-8e4e-1b8208b1538d", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f9885e22-ab7f-5ad1-8e82-67a7a670d0a4", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d0a6e37a-1e48-5eec-a250-a408ed01f48b", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0aec9a58-864c-5e62-9ce5-8ddaed89715b", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:de991af9-dd3e-52a8-92b5-c2c21f23d370", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b3005b2f-4167-5945-8ca1-ecb028ebb00c", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aeb1d768-93e5-53e4-8edf-25f6d3aa7e51", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:66c89f20-64f4-57ed-bce9-beaecd43d4ab", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c2027168-2b3d-5e4d-b345-159a83154358", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2092f0a1-fcf4-5fec-a219-d12bfd4b6b52", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b3b40b15-0aa5-54f4-bbbe-b183619fd70d", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:379afa85-cf48-5e6e-a038-e4a12ca8fc15", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:df9a8d70-040f-52ba-8f1e-8891093ee864", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:098f2c22-eee4-57e6-8e1c-01eab9cd8ec1", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.5" } ] }