{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61b30232-4534-52d8-800b-8fe04310f7c1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:478bc21e-74ee-5d49-9298-54e5e74dc39a", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2e82de95-f509-572b-aac7-cbb9bcddddcd", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:394a0d07-c1f7-54ef-bd1f-aabfaae2d22d", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3530ed49-3c47-5d36-89b3-e7a26913a221", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9b0d8776-f134-5421-8a6b-44d1666b2018", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:397ff1d0-1513-5664-8160-62ef51881c1c", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cd4f44f1-d618-56a4-b126-abebe4767b3e", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5a4d2d42-841b-536b-a8d2-28b65caabb8b", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6cbc7dab-4260-5853-965f-7ca1b5092165", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b1e6276f-8738-5ef8-92d0-eadb75ff363c", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6b3a2c49-afa2-526a-b8e6-020a7be86baf", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e62ea877-47eb-5e0d-bbad-35e4d8e8d511", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:31fae0b5-c7f9-5e00-9e43-31ca12701698", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9c751dfd-905f-5c66-ab96-aa623c1e69de", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:723357f2-d427-5d8a-8c23-4c7ee7d2d98c", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0da026fe-f98b-5c02-b540-6d90a1e17a68", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:725e5578-f973-5804-8fda-91eba1c8958c", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fab73bc2-52f0-5fa6-a868-24a8152fa712", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c4d488ce-cbb4-5598-86c4-65399c4a4bc9", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7120f5f7-ff1e-549b-b08a-edcbe803d68a", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:15d2e31a-e939-556e-ad2f-558d9abba5cf", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:156ebab3-fff8-59a4-8772-2091c5a1c49c", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:896459b2-e163-52c3-b5d1-77297803b44d", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d838e53d-6131-54dd-9af5-50b3b1be8e6a", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cfe1c304-9eb9-5f87-9a7f-0bc60bd1f500", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a7598bc5-3f77-5489-8c55-08df31aec2c3", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aaf22cb0-5367-568d-8b32-e3786cb0e5ec", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a9b9627b-2ff6-5350-8357-b4495f6a6a35", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ee20969a-4e74-5c20-a029-46382d236974", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:30b91257-3b5d-5e21-bbc3-e9182abf14b5", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7f3ae7e6-3749-5507-9aab-5ae556758b54", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c63411d8-c2fe-5164-b232-5b44ac633e45", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6db758b0-bd2e-5e62-852d-a47256f08ea5", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8e03e018-460b-5000-a24b-6ea983a15764", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:98eaf218-dbbf-5cd8-a2e7-8adc88964e26", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8ea09fc0-78cf-5377-b401-f5073932c21e", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6b1a8ecf-8409-5ec1-b48e-6350e1d9fa12", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5d5747af-ac68-5a8d-be1e-ef83436126cc", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:12c8b53a-cc83-573b-8d17-fb52ca84b9ba", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:82b9cd55-b27f-55a8-b43f-4ede13cc88d1", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cdedaa61-caa1-567f-a68f-81c931f6254d", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:262cca2c-07dd-57c8-8109-be48b57f8702", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.4" } ] }