{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:553f669c-22d7-5213-94bd-456833f16202", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "4.3.30.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:148f9be7-a05b-575c-a202-fc8eeb2cd08b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f9ebc421-f7f1-551a-b7f2-24bd6f9b4ae1", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e4a78783-1888-52a0-abd3-0bf9fc9d9b4c", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5fcf6be6-bdf4-5ffe-87ff-b86deb7b6c3e", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e8413959-f22b-5366-8115-787d8354d3f9", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6bf62381-3262-59a4-b801-9853f84e0349", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:50d15a62-fdd3-5823-af31-de19e5f2ce40", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d603d602-78fd-5d5a-87d5-1aea15eb5586", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8aafb5c3-8cb6-5446-b609-08ef5973c91e", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6f27912a-b6fc-50f1-a3cc-1eea12d4baed", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f76d7db5-70c1-54bf-ad34-920dd968daed", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:99606092-643f-5db6-bcf6-ac9e473cc492", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:22d03c0a-010d-5538-8180-8c81e6740a7d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:30291fb5-eff4-51a0-b803-fee08622cec9", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6034b7fc-e63d-597f-b083-ad6415511f89", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b8b4aaa-34a8-579a-86c4-e2570b92a1b7", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fe0c28fe-908e-529e-af99-a91b63bdbb9a", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f726455e-72e2-5dc1-a59e-6e42d42ce1fc", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:23943040-3e81-594e-929c-52030c7112b1", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:11f9ffc1-52d7-5991-9e71-8ccfe7947eca", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:42026e78-a6a4-5509-a1bf-cc4881298f8c", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1d0dba44-7659-587d-94ea-d45336ce4b34", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c47d4f30-95e8-5322-93b3-218b2ba268da", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:903eb1d2-ba55-563c-ae73-38ea0c673d79", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6cae5ee8-1816-5298-aed6-ac4f9d1fc23e", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d4e712fe-7f3b-5cfc-81e2-1f3cc37bb957", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bc716b41-a0fb-523d-a5b8-b2d7ad05c9f6", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e744defd-2e88-5aac-8c21-57cd5c07fe4d", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2465d575-c54b-524b-bafb-4ecd43b9cc16", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:be01e789-49d9-593c-b9c5-4708dc51d307", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:75505782-7a2b-52cc-9bc9-6e01d6b9a63b", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:47b3d4b3-78fa-5c9a-946b-27475575609b", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a1c9cccd-7744-535b-8319-08eab928be23", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cf96e876-69ff-5387-b690-03fcce8896e3", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ccf01aad-7b99-5d60-9136-0d7d342dd19c", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:db9c4d32-3e20-5d03-b5df-11ae1a6942f4", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:81e1fca0-a56d-5d5f-aabf-c0f03a0b3ab2", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7a1b2112-6154-502f-8960-d22375bdbb57", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cc4bb58a-d912-57bf-ac47-373b7ae7a3fd", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6d7fbfcf-f43e-5147-ac1e-e45c4408ee2f", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:47db3cb9-d522-5e7a-a1a4-f0eb9488bd93", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7990cc49-31ed-55a1-9a9b-2fff9e03acc2", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.5" } ] }