{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9c55d750-d541-5488-88ff-0c1e29742b80", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "4.3.30.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6e309a27-1d66-5ab9-ac20-f9904bc97816", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bf2c4bd5-6509-542e-88f5-84988828ddb8", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d57bc6b3-4781-5987-ae9b-54a40168b20f", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7ddc68e0-3c98-57e1-a322-fe80e2592df5", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b2213a30-151a-58e2-a3f3-59a809249b0f", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4b3b8ff5-edaa-5aa1-b5a9-0e4c870f24bc", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:886314fd-236b-5b4a-b273-4628cea22816", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:54f8f4dc-60ba-5157-8bb8-4e45fabac1b8", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1d038fec-4a9c-5d6d-9e0a-870ce3e908b3", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bdd3e13c-2b78-5c6e-9fa6-08b7a97d3f1e", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:70ea9982-8e37-518a-88f7-7d3e487c9fc5", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a10afcf9-5c2c-50bb-aefe-26cd0aa37432", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cc3f24dd-8246-5782-a863-bd8835ab6cef", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1792f6bc-9893-5906-afab-8a30ff722853", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:82d87c2d-7d8d-5b08-8683-3ca7942b730a", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5df8ead3-bcfb-5269-a4b8-5b70151115ea", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a4d29157-c7eb-5c4f-b4b0-a3734846c689", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:733394ef-6fa3-5b55-91d9-5ab45ac019eb", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6d07daad-48e9-52b1-b000-c5ce1095b27a", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:40a2030f-bace-5850-a3a4-ab7ab22586fd", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2082c61e-a9a5-54a1-a93c-c8925167da1b", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dc2a7be4-5e04-5a32-b476-038ca42d519f", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:38266aad-838c-5446-91b1-7e3e3abca5af", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:94793587-d5dc-5631-a816-319bcb570854", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e3c027a-df1f-5385-9c7a-dae47a330be5", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2467d1f5-d572-56d9-9094-bc9077aa3ad7", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:90c966de-f270-594b-8e50-5ade3b90dabd", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c21a5f5d-8e53-5365-8d4a-84605b01aec7", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:34c1b9d4-f798-5b70-8dca-cf8e94e93d2c", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ed0ab0d5-2722-5d89-937e-84ca9f3df66c", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fe96869a-b7b9-5c3b-b37b-3912a2b749c8", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:37f071ee-cf4a-5d35-995b-0920b20cd827", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5de4265b-ebac-51d8-a144-fca67d654557", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:839aca9b-2329-5a2a-9e35-9a1754a9531a", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dde655e1-17d2-5118-a922-67efffc24c27", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8588f0c2-cd72-53c1-b6c6-35e215b1517e", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ebd48195-212a-5685-bab3-26ac3a6de8a1", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:772fac52-9738-56a4-9ea1-43f6bdefbf06", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f0c79ec4-2020-51f8-b59e-09477f412021", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bc7e8ab1-19d9-5c92-b164-e25ba5aba0de", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0dfa8202-cf69-5e04-8c8c-c8b3444fb022", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5088c696-d01a-5298-bc15-45ef41c49ff2", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@4.3.30.RELEASE-tuxcare.6" } ] }