{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:baaafca6-f97a-5fbd-a33d-274137fb6f92", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:70ab3a5b-2908-51ac-8ef7-7446cf875946", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:30e57de7-d4b9-5c6f-b67d-526360a7a6d3", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2f4e2060-2362-5b25-b042-5f88042b1bca", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:adb168eb-eb76-5d17-8dee-08374224ab91", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b8365444-1160-5456-9798-e06fd81127ab", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:32a9e5f9-cedd-5fdf-8a3c-9b24fcad8e49", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3fa03a7f-06ce-5160-ab20-20e428732dd0", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a4f11478-8623-50d1-b6e2-7f5912729973", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f29707da-117a-51c3-89fb-88465da8c8c5", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b9e0c16f-733c-5577-8a31-b92d7b504c95", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bde5eb05-2ae4-5cb6-9bed-61b3a1fc5228", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d7a9ee4e-7de5-5edd-b5bb-2f33e1cf931b", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:88820b8e-8807-5233-b512-9b8fa6d41220", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c4e4b3c3-cca2-58e6-87a9-0c3e80151c89", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:de62635e-fb02-53a2-8d6b-89af548ba717", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f6bb0bd6-c21c-580d-9454-5171e983c9ea", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7158c6f8-4ec8-57b6-b7ca-3999f438874e", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cd8f5719-d762-5ced-b7f0-efba2b1ccc0b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:102037db-f5b4-53d7-8a8d-24c2b2e47de9", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e39f7704-280b-55b4-8e1f-5984e3762db1", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9de1dfed-b773-5e66-b929-88878becb955", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:775ac9b3-9609-5852-8fe7-6ba850f8625b", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4a58fef9-ce9f-507f-b4fd-e5c272150076", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6a55fbf5-085d-528e-a72e-b1979e91f8f6", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f608b381-aa50-558d-920d-209f2f532f26", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:83fc83e1-7da7-5a4e-b12b-74654e4f6311", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:be384048-811c-533a-8716-a4a56bac1942", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:863dd97f-2a16-5d1d-a0b9-c41982feb783", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4eca5668-800a-5bdc-b037-744832271d60", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:033c3fff-7f8b-516b-8249-50cc65445b02", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4431588a-5ecb-52ad-8c9a-796b4c95ddd2", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e0bd327d-7efe-56fa-bb4f-5997bda51995", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ace8cef6-de1f-5cd3-a9f6-fb9e8874fe1e", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9ef144b6-e279-54a1-8dda-5e08be2e4b60", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:357130ee-358b-50f6-80da-1bea85c17196", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4d445c70-cdf0-58a7-960c-81cf86ef6b0e", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:15fa8623-adb8-5b8e-90ff-0f08e1f2d156", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:91cae470-c684-5b58-a350-f9b061d0a730", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ec4d0382-c9d2-5299-b0a1-f65cfe7e6460", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c3cea17e-7ae3-5072-9537-2ad1a6d92ebc", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1f14f52d-fcef-5b8d-a5a6-af92cbe641f0", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3a575e7f-2ab8-55db-8626-dafce207e2b7", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.4" } ] }