{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:df8dd351-ab39-5008-8a5d-4de775fd6dbf", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-jdbc", "version": "4.2.9.RELEASE-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:965dc8e5-9131-54e0-9c70-ee9bbdeab474", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bb795b3b-0730-51c8-9c05-ddc444d99152", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ae3108ec-46c0-54d2-94d9-50256181251f", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b390f52d-2469-5013-97a2-70e98310e46f", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a2b66a62-7a22-5fa4-bb95-b8f9ba32c5e3", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:90fa814e-cfb5-5118-ab7b-947199ebfc64", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2226929b-de0a-5815-8e80-974aef866dd0", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d4fb0513-80d2-5756-bfc5-aa4e61ca0ad3", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4752d5bc-2ce8-5e6e-9b16-0d043a652ce4", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8701871b-e079-591a-b0d0-00566bd0f729", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4dd5cd25-6135-53ab-ab1d-63532c33bbf3", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1789a5ea-98ed-58c0-ac70-87ebdd29b634", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:67cd5e1d-27af-5989-9779-33c73958a721", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:38515a27-b68e-5662-827a-4c4a7073b465", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0508ab3b-3b02-51b3-bc3d-f903812e2af6", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:90b74c9a-c728-53ca-ac44-163003874403", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9650ae4e-fb80-56fd-8502-b2fc0dd1a20d", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:815862f6-92b4-5b8c-9ed8-e6e5be462f02", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:70a382b5-91d5-5ce3-8f31-cade3197c729", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c60f656b-7912-53e7-9b28-dbafc6007f39", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1ebc74eb-105e-57b8-b2a3-705f882c62bc", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1ee2ff83-03ac-5a1a-8ed9-c41c74683c3d", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f16ad546-8414-5077-baac-3695dfd59091", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2add8ea3-715b-5aa9-9816-eb2588c2e28b", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a2afabae-3613-5811-aa81-b5e07df0e07a", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8dc9cf01-0940-598b-9a0d-ccb0cf5b0846", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d016b3ad-519b-50da-8197-d55c501394a3", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e8b4bccb-1108-5776-b9ff-4ebe993398f1", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c5631239-7a24-5a87-9771-4b40e9c6835d", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:51b8e246-189e-5458-84e7-f3acdc84ad38", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5a5f17bf-acb2-5e43-b108-a105438ee8c9", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:53679699-5e59-55f3-97ed-525a9213272f", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:57a86e21-1d9f-5a42-968d-fc261e987423", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6f0e32d0-34af-5b5f-b5fb-6cf46e386975", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bb79bba7-0c7e-5976-b65b-bba21090808d", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:360a593e-a7fd-5059-b24a-c7885329a7ba", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:feccfaac-46b4-5b56-856e-cff2df6a0836", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:74d78317-e54e-584a-9054-aa5e52b3174b", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:da4c20c6-9c4d-58aa-806e-4544ee3c40a9", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2319fd49-9b57-5a81-a90f-6d0c2e5f1b11", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9a6de68f-bdac-5f01-844e-ef6632b9aecf", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:671cc1f3-aa6b-5679-873a-45b5026f40eb", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9ebb0afb-2ae1-522f-88cc-a7a4e922c2b2", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:790f9ff6-3e8c-5396-b041-becef33fa808", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e4f83751-4a28-51a2-b009-ca963a66fd98", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e0a89258-7aa1-53d3-9b9b-45e9f7676c60", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:15f51a97-dc3b-58fc-815f-b99cd27f675e", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-jdbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@4.2.9.RELEASE-tuxcare.8" } ] }