{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2df799fd-f1af-5f8c-9f6d-16add9db5a08", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-webmvc-portlet", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b4dfaa28-eb3f-5878-a9c9-e554b0203d03", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d0e5f638-8d36-5f99-a8a7-bfcf860d3928", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ebe3cbc1-8fa5-539e-ad3e-1277ffa02659", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f4568731-ea23-5a76-8076-0a35869bb04c", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6df21693-78c1-57b0-bdab-601016ea4ded", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6b095474-3b1f-55f2-a62d-6617c727447c", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dd92e141-bd7e-5ea9-bc01-0121e1ae314e", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e928b97e-a7be-5800-9b90-b211ede313ad", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f01f38c5-7bbc-5289-8e86-4645c873eb32", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:376060d3-7989-5964-a9d1-76001138a451", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:614b87d3-256e-5a5f-b346-756b832a82a0", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e25d377d-35ef-5d09-a1c1-6670e10646e7", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9b717ab0-9ee4-5c8e-9437-183a8bf23281", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3540ddb3-16a0-5956-80f8-08045498daf3", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b7adc832-d81f-5459-80de-c9a7c501b59e", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a456025c-f9b4-5925-aa43-0ec3f24c406e", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8fa91b06-6775-52b5-a6af-c314eebe4ac0", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:adf01669-e44c-5ebe-84de-8ade46c1101d", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1d829f73-962c-507a-aaae-a112fc7ba076", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e2aacf9f-761d-5a9a-a69c-619c8bf8d784", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a331f492-a4e9-5fc8-9a5a-8922f4589210", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:73868454-f093-5120-87a1-61d5f8545de1", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ccc6e41-476e-54c8-a379-595163feb768", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2c8d0131-063e-58b5-bf05-927a38230d83", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:43cb6910-4bf9-5b36-9c20-ead6fde2bdcd", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d052e2ba-250b-5ca5-86e6-9d6367e48d9d", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9b156d46-a18d-57d0-898b-ea22109491ae", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:57340ddb-e0cc-59c9-9b7c-38c5e7424f9e", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ed9d07b7-29aa-5359-9187-73272fcd1632", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a51a3631-0bc1-5c9c-b8c8-042b00567b36", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:808e7dc5-ece8-5876-95ec-28cfbbc67554", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2314ade3-54d3-5cec-b685-f31471e6e072", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7c70bd0e-6d7c-5ad2-a346-2e64267e5704", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1eca8c53-184d-5754-a9f2-0e7be97aa15c", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:721b3e9f-d606-5cd5-b2a1-1044a5ef9df1", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:71dc67a4-44fd-58fc-874c-d887cabc5862", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ab4ea080-703f-5e38-86ae-d45b40bcbb5b", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7d85878a-49c6-5bfd-9311-205daaf449ac", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d360e222-f213-5a90-a4de-6e7db25b917a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ef6cc8fc-b5a8-5f19-81b3-82f97abb6ce5", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:77c68dfb-af5c-5ebf-afc7-ac4451f63b0c", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2644fed0-d2f6-58c6-9c59-6c7e17c70e49", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc-portlet." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc-portlet@4.3.30.RELEASE-tuxcare.4" } ] }