{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:84dcf6c8-9455-569e-ba7e-091ece1a95d9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "4.2.9.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:589add68-2934-5dec-a92f-2d6d472c50ac", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b0084027-8ef6-524c-862f-acf7710cd63a", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6d6ac08e-1a62-517d-b94f-9325072809de", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a1012cb4-b4df-5b75-9e38-423ec0341f8e", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:28b1d04c-3bb5-58c2-900e-8088c667dd55", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e74ddd0e-dbc5-572f-bb52-c31c3d1273bd", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:07a65588-efb7-5602-a7a4-584bc21b92f6", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5396d4e6-39ef-5610-82c3-ccdf63e8b395", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8e271c2e-88cd-51da-9d96-95fc54f15776", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c1a7c87a-d257-59b4-a48a-5a2a8b96ffb3", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2c58e97a-d459-5c82-8f18-6504fdef175d", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:10c1a5e8-afec-5f24-9d35-b3e574d3c304", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8f7d0180-b1c3-5257-b832-bf482c469283", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:22fc242e-657b-586b-9711-485d43b16dd2", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:826b16a6-f68e-5876-8625-09ebeaa06e38", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cab72396-2c14-5807-9f35-fc3d4ebaefe8", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e6202db8-44d3-5638-b5a5-6d992805a3eb", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:1a2581f2-0321-5aac-845f-beac2b768c8f", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f08e6a84-098b-5f66-b86b-e27d67294ea2", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:007d6c5b-977d-54c1-9dc2-fbb9e37f0c25", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:443d1f62-9f52-5d43-8695-d11035f7bace", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d78824ac-4f0b-502a-a32b-f29aec737a43", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:51921b6b-9e4d-5104-b518-fcceb55e94fe", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2e44fffa-4fe4-5741-bb8f-d00aebaa4de5", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4ac2e6cc-8709-53a0-83ee-adcd57d4e97e", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:597185cf-b329-5d3f-82de-60f6394cb9b2", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7c96c8e7-2258-52ea-8926-8e3ad960ba8d", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5125cf27-c8ad-5193-9f7b-c7c07594a0d2", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:75b5c68e-13e6-5359-90af-d5f462db10cb", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:39d02b1c-64e6-577c-b38b-61d762d4174d", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:239feacf-10a0-519d-b2a5-7554689ebac7", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fd920785-497c-5cef-9972-3e1e7e281617", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d0508a41-5c38-527c-9555-ebded193d666", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2d296f6f-0c92-569f-9ccf-493ee868b683", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7f6348cd-7820-5338-aabd-50a62eaa64e0", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:861fac6c-04ca-554e-b780-f1d2eb7d5c28", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:008ef780-5492-511c-8f9b-cf0bf24aa3be", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bf3355ab-c58a-5bc8-ab24-bbc20ec9ae7f", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:31d09827-9686-595e-a045-9f71eeb6d64f", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5d118e13-03bd-5fc4-92ea-c3f2371fd2bb", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3d60d5b5-6a2f-5dbb-8366-10c6836549b3", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:42dd7287-7a1e-5e24-b7bc-dfdaa45e3af2", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d2d82d9b-36b8-5223-a868-fa4bc7a33db6", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:69c10ae5-3563-59ff-846f-2bb1366810fc", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cc9b1f1d-dae6-52ab-9af4-3efb54e93f65", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0e36d8c6-3520-5b84-b7d8-715e14ce9926", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.7 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@4.2.9.RELEASE-tuxcare.7" } ] }