{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:529466f1-bf04-5a9a-bad8-a9426c80f172", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-context", "version": "4.3.30.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9aaa76f0-5416-5ea8-92ee-da5d5922775f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d9bba1e6-34c8-52a7-854e-368cbfc966bf", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:140f6c8e-5752-5cfe-af60-ef5964a6be0b", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b2372059-61c7-510c-adbe-543b061d9c0e", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c219b065-d3b7-5672-8183-d98430e553b1", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1799bf96-61e6-5af1-8351-1733cc8b6001", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:174329e5-988b-55d5-b839-b1c9399492d4", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e2ee99be-964e-5b49-87cf-93c1e2346dad", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e79cd4f2-41eb-571f-b47b-5faa3530a970", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ab03350e-68f8-5d27-83e8-61f31456e853", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7616bc45-211e-52ac-ae75-333eae22e4fc", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:87f53823-ae28-516b-8c55-19cdb30cc517", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:758742b9-6f31-5922-b077-6df8fce444e4", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:68b9510e-e231-5d88-8ccd-dd9d6999b86b", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9d5b0f27-d02d-5408-92c1-da0b8aa39b3f", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:058229a3-5b42-507e-a34f-7da8bea65787", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cd51e55f-7eb7-57a6-a61b-db90d6aa6c7b", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:479b5e35-f78c-5fb5-bb9e-e1c822c1620e", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bd0e2f8a-d688-5b7f-a166-7306ea76ae79", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b53cae35-0bbf-570b-9c81-b9236f734e6c", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4ff6ca19-8fcd-50d3-b1ad-1078278f98e0", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:facbfd36-cbf7-5fd5-9386-42f966ffe928", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f556903c-b541-5862-a9ac-5f7a9a879edd", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cf1031ea-cff4-53a9-8135-8a42e2ac7d23", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9372d528-9849-5e87-9173-37d10ca9c649", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:38cb38cf-c86d-5316-b7f8-c168b091236a", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e53d98a7-ac82-5685-b33d-04b2bc422bea", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:973a3be6-a6fd-530a-a776-285f1a1ffac4", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:032ef2b4-2bb4-5bed-8e4d-e5518cd1d112", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:923f6611-cba6-50e0-ac4c-f27f66c93a9a", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9e3fce83-f67f-5831-912e-dc4ea53392a4", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:80144c65-93a0-5d06-ae65-eefaf2c490b6", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:714bd97b-e367-55ae-ab47-6db91ad09969", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de592f84-0073-5a1e-9a8c-0dfdd8006798", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:59eb25c4-8a43-5a78-ab5d-a391719536f7", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:123e3f4e-4c05-58f3-bff9-0aa38c197e2b", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7cfa049c-9c65-5048-8a5a-52614f9550a9", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1f0c104a-5ae5-5dd2-a114-8d6c7b667979", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cc518f2d-921a-5d39-9d29-3d022087bdf2", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1ee2c2b6-6c8a-54cc-a344-d950b3352bd3", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:26b5058a-b7e8-5c79-8764-79539524eccd", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7316e403-901f-5395-801a-757574cff5c6", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@4.3.30.RELEASE-tuxcare.6" } ] }