{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c727b8d-9db7-5d92-aded-a9a424c4318d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "4.3.30.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:91bdeb41-a048-583f-8330-013856571a49", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e61fdd47-4033-527d-a884-1f76374cfe93", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fdc450c8-1121-5294-ae3d-63690837b6e4", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0dffc891-771e-55fb-958f-dfae33ce74bd", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a0ddef90-d79b-5ffa-afec-644c89240e34", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:588e6b72-9788-550b-8e9f-58a42b6ecf1f", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:84e8ee61-3ca5-561d-a349-93a646c7aaab", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a3350110-bf1e-5569-82b4-e731e4cf1f9c", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd2fbcd5-eee9-508a-8449-e0c8f0b8c2ec", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:82f9caad-8b7f-5de4-9681-a52aecbbb046", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:19bdf807-85c9-5612-9ad3-85cb2e469cbc", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:60618f70-cc1e-5455-a0ee-ab6cf1ee81b3", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cb35a6a7-ec0a-581b-884a-5bc52ed3397f", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0cf5308e-19e5-5912-a89c-c8ea36c9ebd4", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:85a4d60d-42f1-5f92-ad8f-598295a2d6bf", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9ad78299-ec12-5622-98a5-3c4d6e655c7a", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ede29347-218f-558d-822e-18432fc09311", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a4d0bee2-87b6-595c-aadb-68e90f4b4c2b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f5b48140-1c20-50d7-a88e-be3067b88df3", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e49bf7aa-68f0-511e-a4ae-2c1589709e9e", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d23ac5ca-80eb-5913-a6d8-4c546b9b01be", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:73ccb621-92ab-5948-a40e-b24ef8301934", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cbdd1b8f-644a-5278-bfa7-3189dbe8d4c7", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f7fcea93-f1a7-5065-ac99-cb1466b0f699", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ee76e27f-6605-5e43-b115-d2d0bbd6be6f", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cd0c1276-b0f0-58fe-845d-79577778703e", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7a20d280-bc24-5a89-90b0-71e008b0aca4", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f07cc1ff-de1b-5d74-b911-78298481538b", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bf61d99c-7d58-5b7b-8937-05a29509c6ae", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f79a32c9-daa6-5508-82f4-09185bf41787", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:555ab9a2-16ce-565f-8035-1523daa1ed32", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f4ba68f8-fd50-5f78-ba37-7895ded7742a", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c38764e2-0a59-5ddf-86fe-4b9ec2a364d7", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:df254bb7-ebfb-5924-b0d7-14c37c9c789d", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8067313d-dabe-544b-bd2b-310a0bf31ca7", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8ff7e577-0aaa-5f4d-8970-58dd28bd6d86", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:48f4e40d-f364-5195-8161-78e56ee0ab6c", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fe5a4528-1326-516e-9d43-42d19204755d", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:be2a8484-3ad1-527c-bcc4-18b70575fa80", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:50794c3a-bdcb-5915-bfda-24ae86121b0b", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e2323f6b-fe1a-506c-a6e8-b8f8aaec62d3", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8a3da7f-6c5c-5951-8d46-7a71301b431a", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.30.RELEASE-tuxcare.6" } ] }