{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3df82bdf-e986-5ad2-9786-ace971932e34", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7683d73d-5f52-512c-ad4d-3fefe11630f5", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e783952-c77b-5c8f-99fd-4ccd2c0f3246", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7723c30a-efc2-5430-9461-f8ede26e7f60", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f38da673-5b16-5ac7-883f-6da0b1190ba9", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a5c6afe2-abb2-57fe-b097-aa6c1c745a01", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2b2467f0-a7c5-5dbb-801f-a694f563648a", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:207b1e61-59cd-51b2-a2a2-91193383ac90", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:252cfe9c-50e5-5bdc-a6f1-4efaa53d0f57", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:94520fa2-615f-556f-ac01-41fbbc183b24", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:742f6eaa-5077-520b-9ef0-7bf0acf20c3e", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de3fe087-10e9-5f31-b78a-22619f20e6f1", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:49947ed5-3a39-5768-97ba-2e72448219df", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6f1ef418-b790-53dc-8c95-f8c7e838d1e2", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ddf4707e-6027-56e4-b34f-d3cbfd59ea4b", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef4a2845-1b7e-54b8-9aa5-7f597edf5401", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b14d89b7-29cb-558e-88b0-b5e994800fb0", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2e40b0fa-1d0e-53ae-af83-15922a05f433", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dd74c0fc-5ced-5d2d-940e-8f3dfc449efc", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:81a2fa7f-49bf-5d96-8f1a-0f1304d4ecb2", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:30dcadc9-203f-5fce-a0f5-d514f59278cc", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c05bd799-861b-56b2-9004-2c1b93e001e6", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5f1649c9-f4c1-5ca3-aa3d-922b1ef25bff", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:19d30caa-c3f1-5d2e-a23a-80c44d80ea86", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:125d62f2-08f2-5a03-99f3-e5bc69389f5a", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7c93b01c-ffb8-5881-ac57-0a9fc21fcc13", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:76d85bfc-54c9-5e10-8488-a8c5d62e6b3a", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7265b9fa-9789-5bfd-a216-c93549f16fb9", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1351d35e-82a6-53f1-a91e-6fa5081b1d6b", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b8205e2e-b358-5a0e-af67-49a8555dd227", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:717ff72c-607f-5020-a9bd-af7eae87a9e1", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ba7ac7dc-efc6-5a21-a081-f12a2e906217", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dfdbd4d3-8633-5cba-b461-3273e048a4f0", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9450fc2e-23ae-5dbf-97e7-96e6258e17f8", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9dddca32-838f-5ebb-a2f0-490b7c82efc8", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:866fb11f-589a-53b1-8be2-0e9ee0deb27b", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4e93c338-5a78-5c0e-a3e4-ac731d6cdf1e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ad4bd32c-8223-50e4-a726-e0f3690469c4", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:855a8f9c-217d-54f4-861d-3250d2c6bdd7", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8da130e0-a98e-571d-a54e-e00064a9fc68", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7238bc83-af35-5e16-ac46-9dd333af1e50", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:df39dbcc-1f19-5bfd-9720-221cff048209", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:24733c62-4ab7-51c1-ab76-842861175697", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b2226705-2148-5358-9a94-a334bdce9bba", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d2f812dd-c470-57df-a72d-ee6314d1a3d8", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e552ecd4-15e9-5f99-b9c8-73ab7de0f0a9", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7167b109-df70-52d2-b9a4-ff2c4a6a9003", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@4.2.9.RELEASE-tuxcare.6" } ] }