{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:499f19d5-c1d9-5abd-925a-42099b29d8d2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-aspects", "version": "4.2.9.RELEASE-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:52a03c41-8b2b-5b0d-8e3a-b2530091d5a3", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:05792c91-6524-517e-9915-fd62e8c3523c", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9c66f785-c771-557b-aed6-ac937961d3d2", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4c58b4b8-feec-52b3-a93a-6e8ebbdbb6b6", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a125ac53-a323-5d95-bcfb-1a1d795dc9eb", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:afc26fc9-29aa-5859-a482-070e2ae39218", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:767c3f5b-2f6d-5e0f-a9f6-cfc50788905c", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1228211e-779d-5f80-beaa-73d383260618", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:47e38207-43fd-501e-8bda-fe1c27103091", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aa9afc88-3f4c-5e67-89f8-fa600d674278", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e968b754-8da3-53c1-b4b2-003592ad4a35", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8750675e-28db-5e80-b926-db5cf5589b16", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:295be8bc-9097-5f37-86a5-61846a2b2d93", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c929951b-3784-5c3f-b185-f622c3de8f88", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b655a67d-06be-5aed-a6a4-f88c27332942", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9d56cc81-456d-5acd-a054-2df78bff75b6", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:185bc914-7232-59c7-a027-0883be823f5c", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7def9006-7bf1-53a9-8bb3-588d81836eea", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d198e0ce-0a91-5936-b514-3a2bd0476138", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5d8800f6-0bbd-5429-81f0-4abe88c26ef8", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3bb0a4ee-beb5-5761-ac75-917fc66b2652", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c2e85016-746c-5531-a52b-9a4414190c80", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9008c2ab-778d-5af3-860b-0a694fb4cc29", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:374bf6ec-ddff-59e7-87d2-0195db015467", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aebea7da-be54-598d-93ab-5859d8f7a374", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d6c48071-9711-57b2-9eda-a383da418232", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:03131ebd-ebd0-5175-92e9-40f116e158c7", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ed3c2c66-2d97-58f2-a67d-4ece4cd70fd0", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:03a2aa26-fd4f-5b54-9a7a-5085b877e1a4", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:373746ec-cd4f-57c4-bff0-6133ea7c58ad", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7ccd4581-afbd-5736-89d9-16b7c0d04805", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:74992cde-d70f-547e-a3b6-50c6ea217600", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9738c3ec-45a2-5d2a-a717-f3945fbed8a4", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:35fb4540-fab5-5faa-875d-fed75e8a59cf", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9e6b8fc7-876c-5c13-979b-f9f866cf1add", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d7d65913-2bac-508a-a5ab-53fbcd881d8f", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7273516d-be6c-58ca-9c43-055d7e6b95e6", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7fc2e3f9-4e17-5f14-a6d3-5f32d0c0ccbd", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c42f5f6b-7053-5f5c-9b85-b6448534c255", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3ea750c1-0261-51bd-b726-fd7403ff8405", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:25a24470-9dfd-5bdf-b94b-26d8450ce138", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a34ea4b7-080c-5f3c-b6d1-5d6d61da3d7c", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:abb835f3-1c66-50d2-8afa-9768fa34798f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bf33bc5c-307b-5fd8-ae29-8d254099394e", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:32ec10c0-68aa-5935-818c-858e85afb243", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7ff25c7a-6417-5108-9421-c276e43376ce", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f5bc46a8-d328-5bc5-9d42-df701bcbf8e3", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@4.2.9.RELEASE-tuxcare.8" } ] }