{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f2b6029-fc98-570d-8bf7-b0fc611de8ec", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-tx", "version": "4.3.30.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:59ca4a50-7ef9-5372-9115-964c07254536", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0f22dcdc-19be-58b6-9f4a-b5b38a3ebd11", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:470117f8-0b4a-58d0-a26a-d2fded652442", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:501414ed-e91e-5035-a431-644c4c360699", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:84ada8c3-fce8-5dcf-84fd-fbf5149246ce", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ed0616df-7760-53eb-b95e-4751c1dc6f7f", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:647b5d2c-7d8a-5101-aa26-bab41a03a2d2", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a79cbb4e-7fcf-553c-8690-5989bd371e69", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:045c4391-0b27-563b-a1bd-dda7f6abd48f", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5d8a0288-0d53-5a03-bda4-e6267d7a7906", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:da859796-7498-5de9-8209-64278fd30b2b", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3f69f9ef-65ca-59a9-9b0b-ced2621b4a07", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b8efd6d1-4fef-55ba-b082-25ec6c2d4226", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:10848656-128e-5801-a6f9-1a0162385df2", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e41bc9fa-5f03-51f3-b9d1-8e7927773838", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:16915e95-671b-509a-b0a0-c207c7a8494e", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1cceefa8-551d-50ac-bbc5-7a4e6ea3bb81", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ad8106c7-c299-54c6-aba5-c51ecaf513d8", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:260fac7f-0332-5f29-819b-344b021d251f", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9d8a98aa-0abc-5e43-95f0-c6f8f25c2730", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2adbaa8c-b621-51f2-a4f4-141eef8d48b4", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e0458e92-1558-5e62-aa97-386d4c04f4f4", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7175e17a-4aab-5d6a-aa8a-858e0cc2dcf3", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:30ec1139-3b58-58d5-9803-add786badaaf", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c3dbd92b-c4b1-50af-8ffd-a0aaa6a39ca0", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d681c227-820f-57b7-a922-015134d9cdd3", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1cac2b3c-e7f7-5262-b2f0-2e490e65212a", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e52ebc40-3bb9-58a1-8761-4ac79578bf7d", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:acf719e3-55d2-5706-82d0-558556202e9e", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:00887264-296f-5ef9-aeb2-76d0d7866b4e", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24716da4-eac3-54a6-beb2-7679af953cab", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4425346a-e369-5a03-8bee-42e3acb24728", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dfb2fad2-2edc-51dd-a194-b93a5aae86b6", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5fed9262-7812-5b3b-a59c-ac43e4d6c374", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:344e3946-1fc0-52b6-90b4-85d23347a645", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e29bd686-fea5-5ad9-997d-dbf1c70f36f1", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:26f757db-de0f-5a13-8ced-0d46fd91145d", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:15d8b987-7e3f-5c64-a3a2-ec146b7ebf8f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a9685866-c8d3-51e7-8e3d-da7dde095826", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d01acf5a-c23a-5537-8298-9972eabe5a72", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d429e929-ebf7-5545-ae8b-5bcfcd711f58", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b909a7a1-522b-5559-9942-b1c8d670eccf", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.5 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@4.3.30.RELEASE-tuxcare.5" } ] }