{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f7171ac4-fe9c-5361-a247-55319d2b01b2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-tx", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:cc3b32f8-82e9-55e4-96d5-f32ddbe23353", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:180bc914-7db6-5d4f-a0b6-43706b5a74ca", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:420f62f7-6bbe-5048-aa4e-e81320644391", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4ee5dd7a-5c07-57a9-b787-cbfedb25d1a8", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ef7507d4-a250-5f9b-9c18-ef0b1f25e0a4", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1f104778-d5ef-54b9-a813-e0102503eca4", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d89105c3-7e76-5664-9a74-9cb5f6d8463e", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cdcec7ea-5f99-5cb0-88ab-8d0fbcbd0b8d", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a7942f25-aa96-5be1-92d0-00d1b377816d", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f6d6fa00-2ab5-5e3e-a48a-2e62cb887357", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a4f1b448-c9b8-50ba-b003-0668675518c5", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:abed7265-0240-5573-9cfa-c2cbf87dc37d", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:774d0ea0-8304-5024-a9ab-e8a64ee9bad5", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0256d6f8-5317-5e45-87b3-56ec0d2f4505", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c89c968c-d2dc-5a05-b916-0be978d31ef9", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:251a69c4-b921-537b-8dd6-abfbac97778a", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:96f0c4ba-420a-5917-8f98-87e947849c29", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8b195e17-ec10-52da-b2b8-514a8d467a5b", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:df64ce91-c8f3-5809-ab52-1b438d304a7d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1475e843-63fd-559e-a340-5030b6da0c36", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c511d2f0-d3fd-5d71-8956-38c9acd7ce1f", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ec8b4e49-b73c-505d-b3d7-7d6d06d077f2", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:66d4bb06-b4fb-5062-8140-3ed8133e9fb9", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:82a39838-08b3-59f7-bbd5-7248c6953178", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5605652d-993e-5a1a-8e66-8cdfaa3e0269", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:46ad4ca9-8dd9-54b0-be35-a9b9026eb06a", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:17afe772-e4a4-56b4-8893-80fac90426e2", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4971de91-0b44-516f-954f-ea67e28f3381", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9cec9cd4-4c30-584c-9e69-33d18c3cd305", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e35a238c-50f4-5cb8-8bb9-fa7ac8d1010c", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:89041b8f-a04d-5e5a-87db-714544a42f21", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a27bd246-7d6e-5868-871e-1e562ad0059a", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8489c333-0928-5fa2-81e1-5f4bd9f589cc", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:eb7bebfe-0f20-51d4-96e0-f26d1bdde712", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c3198dd0-3146-5f4d-ad91-94f1f179d135", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:59c33163-62ec-55c1-bf4b-7052c65a8968", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e79edabb-fbf9-5c16-b4a7-69f48deaa7ec", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1aa61a9d-f625-50cf-84cf-15f42fb54b8b", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1b92c32a-bc25-5041-8c4b-bb2809ac5442", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f3c40ad1-06ad-5246-b90f-ffefb128b852", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7763630d-1ed5-5bfd-a14e-88c7c751c218", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:491cb49a-ac83-5be5-9794-bd90ba6a0b7e", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:59ce80d7-e381-5e86-8045-2af2299ad82a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a2f460cb-129d-52d3-a5cf-75d30940863b", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:843b8ae1-84b8-5be7-b0f6-f87a22da0767", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3f9685ae-4587-55e6-83eb-5e5b8b51978f", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.2.9.RELEASE-tuxcare.7" } ] }