{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b03be5b-a26c-5ddd-832c-c30a1949db0f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d4b92e4c-9a9f-579d-a82e-e6c49442578c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4702ccef-19a1-5806-b014-55a7b13b62ca", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c6e1118b-6999-5cd8-9c69-87d8ccc13997", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fd342c82-d946-5192-a162-eab4c723236c", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a18a922-9317-5f27-baee-5a14b4b79c05", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2c8ef8c6-81b8-53e8-a29a-70e2c0896e38", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cd52d460-4550-52ad-93ea-24cbcb8501de", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:828609f6-9643-53ac-984e-a70a58e8cab7", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f8b1726a-10b5-586c-91cc-133adf1b61ed", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:18fbfd49-c1dc-5d3d-ae5d-88c435a8ad3a", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d641bbae-2060-59bb-afc8-7856c72bff61", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9c5423ed-e97b-5f0e-82cb-1bf6fec88be9", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6f77fa0e-0947-5720-8ee0-d3481831af6d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0e1350b6-ce45-5e04-b48f-c024238a76c0", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e81599c0-bd57-58a1-916b-60d1ab12391c", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d6b91eae-c98e-57a3-b69c-dc4dd35aff3b", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8597f0a6-f9e0-5e01-a43a-0cc325792272", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4eff47d4-6dab-5b80-a42d-1f6b23866134", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8ffeb546-12d3-5a0e-ae67-526b7d0c21ff", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14d85130-968e-5760-ba3f-acc50b8ab9c5", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8423e9a8-a791-522f-a13e-049bbf15b450", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4b3ab16f-57ab-5302-8006-9b146806b46a", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5cb7e55c-fd24-5eac-b9f7-f35ec8bd3513", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aac9308f-3d92-5936-9413-02f91b1a1cb8", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cc60aef7-2008-5342-84eb-de830dacaf44", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1a3a306b-f050-50e2-85fd-5d474e3d215d", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f74cfabd-c1ac-5be5-af82-e561679418e8", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:531dbfe9-8a74-55df-9fb9-9cc863874677", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:853410c1-ca9e-5f3a-b3d4-1466606bbe3d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2a32a239-c9da-53fe-9870-876cff774d55", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a54021da-6c28-5a27-b4c9-41a2c4b6a7fd", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:88f7ea33-1b9d-5920-8c47-a241b575fb10", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d664fcf-d40c-5be9-a67c-837c47177fc7", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:155add9b-c05f-5494-89f1-cf8dbc2a94d0", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c86baaca-0e1c-5063-98bd-556a32179feb", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9e8d230c-9436-5f3f-8a97-f79eb018e829", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f24b76de-5fc3-57e1-bd6b-7b2f70b60774", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b498885f-0e65-54ae-a363-0decdab4f36b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5da6a18d-eabc-50ae-a28b-0dfecf67fc00", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d4f280c-3ad0-5945-b744-d9b9be88f36f", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8e3af000-28b3-5fb7-aaf2-3955e91ffb3f", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bd128881-9019-5ed2-918c-528a6b0f7b21", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.4" } ] }