{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bf959dff-d2ff-50aa-a6c1-5d6715961ce0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:85b0e259-931e-5542-a226-5862d9cbe6c7", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:41dc13ec-57cb-5107-9a03-b0af8bd74d4b", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7f7efd5e-b3b6-56e7-9cf9-f37921b28ddc", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b4835a30-cbec-5f96-abe2-0f8716f25bac", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:47173ac6-9e5f-5f6e-bd5b-35a0f5b03081", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1d2250e5-dfd8-52c9-95fd-5ec90297839f", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:db4047e8-ec20-5ef0-97d3-f49512b2f71d", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bc4e92e5-c8d6-5017-8d4c-2c5417c3a910", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:04a332a5-171e-5d41-a92c-bf1f88eba827", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f59bacbc-09af-52c1-881c-8600c40ed0af", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4d0e3d87-9c4a-535a-81e3-9d322014010b", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5bca6a41-3e23-5275-b4f2-014a16edb8f4", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:70a1bcba-a27c-5242-afe5-e7441bb616ca", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:62d1e586-4096-551e-b79b-a3f0782c4e93", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f5eaa62e-2836-5693-bb0b-992715f819da", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6e3e7db5-23d1-57d5-8bfe-bb64ce42fc62", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2e862114-e48d-5065-89f6-91655a54fb2a", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:66ef9c44-8949-5543-872d-55bd50bdc429", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:896b53d9-f827-5664-8dd9-f2e31da3d837", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e7f9d313-b86a-51c0-806c-2f3cb4e491b0", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a01765c8-551e-5a39-95e4-aab5c85f684c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6cedfd4e-a098-5337-b198-18ed0a1ce056", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fc2e97dc-7be8-5cde-8520-99ec5e4a0c38", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9646fb20-1f6f-5fc4-a4e2-53b0e2bb7d90", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:71ebbe53-cdd7-5fd3-b02d-1664c46684e3", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4713306f-8816-50fa-9fb0-2a8d8290139b", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5c6f022e-faa1-527e-8988-98a9fcfea642", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a8edce8d-b92c-5e1a-ba2b-81936a385733", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:292fc5f7-6428-593c-954e-d9eef0cce37a", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b2484090-0fbe-588b-a5df-d61d129e2c1d", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:08bf5323-fd28-58ed-88c7-af7579bf7d41", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:224f16f1-e678-580c-993d-9c05bd41e155", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:05684c10-4d0b-5585-b053-686d53fb61d8", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:39699ba4-2a8a-5cde-a60f-b900a5968243", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ef37b04e-e4b1-5d81-9583-aba040f70201", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:20089c66-2c46-5e35-a9b8-4ac4232d6432", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:726624ff-4439-516f-b420-cae65d901015", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:73c9cb26-4067-59f7-bdb3-277d5fdbf97a", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b38e96d2-1377-5a4f-903f-37a8c4dca8e0", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7e1d4c5f-7534-5fed-b181-a792c8c2f6ef", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:38f9db4e-8264-58d3-a1f9-065ec3ce8e46", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:edb9ce01-eff9-5445-9035-4ea1c1961605", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b2070dcc-58e8-5580-b154-9d1ebd03cb18", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7f88c3be-9e19-5f70-833b-7f4efe2eed31", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6ed2cf7e-9ad1-5d14-b7ff-3eba9fdc8512", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:103649e5-3210-58a4-a872-c4187be97238", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.7" } ] }