{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:08af3648-6683-56c1-8770-750276862d91", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "4.2.9.RELEASE-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:736f887c-9edd-50d3-b2ca-05065c0647ad", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e4fc5cb1-0d38-5fe3-b006-7234374d6e76", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a3f92d47-8aca-5915-afc2-7ad5b5152fea", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fbb38625-2fa5-517f-a661-13166b63c2e7", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0cb094fd-b866-5f90-9391-f1505dfaeb99", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:611862e4-3bff-5e9c-a07b-97460b3f4630", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e8d097f9-31b6-594a-8dc7-d6f451a72a3a", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:234ce2ac-e721-5749-a8de-b8c93948c396", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b26d9ffa-5710-531d-ac51-ac36a5aecd3d", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9c253bc3-4007-5c4c-b153-f975a6234d73", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8b0b3c34-6291-5a33-9d78-476cb07fd10d", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:18f29dc0-7163-508c-8512-30b45b263908", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0a0536f3-f3c9-5779-a27d-5112b720269d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3c7cc438-c090-5d66-bf04-c89c4681ac34", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2c36f280-0b35-5716-8008-c3b2a226eedb", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aa954ba5-a768-55cf-80e9-7c7dee4ce7cb", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1a48ad74-dcd5-5940-8d31-e67ab00b5aba", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ffaf9215-504a-5473-b8c2-d40cd1a9c6b0", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4ed23fe5-5e97-50b9-aded-8f0b934789a4", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:09037fbd-ab11-5059-a855-8ffb2466b1b6", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:932c8e13-9711-595a-b3ee-dcff5b4b2d85", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a6d88286-d0be-543f-ad79-48e0942a3dca", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d69a8ebc-1758-5db7-8efd-eb2e5668695f", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:73564cb2-298f-53ad-bd0f-ae02bb370160", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b9963738-6372-5b86-8fa7-75843f493c80", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4f60fe4d-cda0-5a39-8446-927618a09080", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bf010ffa-48ee-55d7-baf0-addbc430889c", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3f1ff5ce-f812-559c-8868-0dd3a36a5c1a", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e69d280d-bb12-52bc-bec7-7d070b14ad82", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2290cb06-7948-572d-8566-beb564be7856", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:cab028d6-df18-502c-b74e-4638332df707", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7787b888-b459-5afe-8e98-25a98c467294", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:751f52b8-be79-5b81-8b1c-a38dfd027176", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c824bbd8-739f-57c6-ac7c-065d6752c9a3", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ce8c81b5-f332-5be4-a4f3-51ba0918d26a", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f647e0e6-c943-5bc2-b213-a12845614f31", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5a4ad063-3eb7-5eb1-ae54-a00a17881320", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:02853cc8-2d4c-508f-9283-6594ba88c59c", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:71c328b7-3c2f-5cee-8a01-15b2b4caf5fa", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4f281e2e-9198-51c5-b1fe-60eb74b68835", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a2cd1187-836d-56bc-a96b-7298badc4df6", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9377de6e-606c-523b-a374-38444f5d74eb", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:308a6677-bb6a-53c8-90a0-6e530dbfd2bf", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d225bd2a-60df-5f84-a68e-e02edba5edca", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b8e85a35-12b7-54e4-82b0-b812f673d01c", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c575854e-0442-5158-9b84-02399d20f49e", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e42cc35c-ae6b-5e76-b66d-1ddbc59644d9", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.2.9.RELEASE-tuxcare.8" } ] }