{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:400aa4dd-2517-578d-83c2-6a9c5bc1aec3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "4.2.9.RELEASE-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d2297864-88da-5f24-bdc2-acd4fceee84b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:47295a55-0a64-563c-aa57-71291cdc19b0", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fedf50ea-e205-57e3-a452-30e6cb6a8191", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e0b7b8e3-ca12-570c-824c-95e50d774ced", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8fa10aa1-80ae-5f35-b8f6-267fedce189e", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d75f1503-ca0e-5ed7-b348-72cb6b25f5d9", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:73704e9e-7dd8-5545-9002-3e54bb16ddd7", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:02991c3b-08ea-5529-8202-a9d9ba174706", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b84a8fbc-9b5a-533f-824a-0c819715813a", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:33b51618-9d92-5666-a3ed-63de976a8da8", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d813a04b-dacb-5db1-be70-342c69aade0f", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:531ecde2-04f7-56c3-a26b-5623fa539fc0", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c6a6303a-748b-5c2c-a127-32de84c05f0a", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1dc816af-9c53-526b-b41d-e11c08389ac4", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1aab3ea5-7591-5894-8417-03328dbdd9c6", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a1c0cbce-adb0-53b6-905a-e4c34216dbdf", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:73dea044-1014-5bc3-a4b2-92855f1ad9d9", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:86b8fed9-02d6-534d-88fb-5fbe6e862397", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3b85fbf8-f086-5d00-982a-860d7277b37d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:42d9d2c7-ddeb-5c33-9b6a-7b7de2aa545a", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:190210c9-ec69-5459-95c0-5e3f127807e9", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:da248beb-754d-555f-9e99-bef5a3f86830", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:88abb77b-5667-522f-b715-04f803e049f7", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8a43ac59-0afc-5a94-bb83-98147b36e6ca", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7793b872-dd86-5ca2-9cca-d1ac4f2471e6", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8cf3a874-214a-5e6a-b140-551d3b799150", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:18774281-ecb7-5c89-a9c3-bb8605a81926", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9951c930-8532-5c3f-a869-3a6b2b1d952f", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a6e10ef4-369c-56a7-8479-8a4b3690db82", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e093fa07-91d6-5d51-8804-f55cffcd661e", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3452c927-662b-523e-a087-e38440044c9a", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:05bcd322-102f-5984-8102-8ad5d040598c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0d4db145-2b8d-5396-8fff-4817e10c9055", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c4658ec0-61c3-5cd6-ba59-2359a2781593", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b46d4680-c144-5ba7-be24-0ef35f3fa286", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:eec97483-359c-5388-b7bf-23d8559e8cc3", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6ee352b6-5b4f-5dd2-92e9-df30c5d04b95", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c7eef60a-bffd-5d99-92c5-4892d9e2cbf6", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:35f56f1b-1952-515b-8fb6-498efb4b294a", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1ae707aa-ab76-558d-bb09-a311529ebcd9", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:81a8675f-88e9-53ac-b4c2-54cda69bc1af", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a383e5c3-d8de-52e7-aed4-add9f0a0aae6", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aec25936-f835-5e05-b51f-6bb76d8352c0", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:08a70aba-15a7-524e-852c-6e9f9117941f", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:de590461-f5b0-5a0f-8b08-c32222dd5bf7", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5127a350-81a7-56c0-bdbd-e4d54958a9ad", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0f0cec68-e48a-5e04-8c07-09defdc62524", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.2.9.RELEASE-tuxcare.8" } ] }