{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9d597406-d5a0-5bad-b9d6-f8adc3c30655", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-core", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ee104cd9-64c6-5506-aa2c-ada9553de41c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e566c31c-37b2-5106-a80f-3839b13c21b3", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b9cebcf8-c9a7-51ec-9b19-bd99a62ce91d", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2bbfd7a7-1399-53bc-9165-d32791a58c4e", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a4183610-4ef6-5fa1-b994-9deb2ac69f9b", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e2dd8a4e-50f6-5a75-91d3-34f56e59b213", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:02df5d43-d906-529e-ab5a-928e1e17d30f", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a615e6ae-d7df-5f59-9ace-718c99c73feb", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:70e770f7-5fdd-5183-9431-fc88714b3b55", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:33eb8634-07af-5e37-8e1a-3a145e5bc857", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cefcb29d-52cf-5679-8bda-241fd85f3e4b", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:040dc8e4-b907-584c-b0cc-1dffad555a2c", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:727ccffa-ede4-5299-8956-749777f045f5", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:09e8e70b-781e-563c-803f-9b6766b4adb9", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7a6ff4d8-226e-5ea2-b3a5-2b07646e507f", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7b74242f-5c1f-5092-9fab-6caf32c10afd", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:74bf3361-1d9e-5682-a875-b8ba3c3a8ce1", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4864cc79-9aad-52f2-a388-04e3e66d8221", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dce5160d-f104-5ca3-a39d-7b3692145752", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a8831c6e-9d96-5d78-80d2-46683d520e72", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:83388268-5454-5d3a-9cc0-63764bbc02d2", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:51eb2086-b9dc-5d58-9515-866d76c075be", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f488e033-53c2-57e7-91b4-c43ed9d5655f", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2612f0d7-f9ba-5c59-be51-85506953b873", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c16d2a0b-59d5-57c5-9563-50857d9779d7", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:59a4803b-a166-5198-ba05-fac2c59b9178", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:588bb514-5c80-508c-801a-d5e870fa6b05", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e07d69df-abf1-5e86-8a3f-602a6709f3a6", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ebb42794-e190-5243-b437-527cce257494", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2b664a64-ccad-53e5-82ea-02877d425807", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f89d98e6-aeaf-521a-965a-f0837df267ce", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b07ca3df-cfdb-540f-bf6c-3c9200f0339b", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3adef667-f6e9-525f-bb53-8e44a6951589", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:28bf134f-de6e-5c50-a084-e32aac7c4437", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c2e5798e-54f9-59d9-9c52-3683cbbefca7", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ea3775e7-9d64-52e6-8442-f945e1f1d7b1", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c34a0098-33e0-5cd6-9e09-9e650f0143d6", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5ce90a10-e1ea-54dd-adf7-5a11f2713897", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f954b3ea-d87d-5a49-b4c8-30c2f9856a72", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:98b3a29b-ef07-5583-8787-2a4ec88ab0dc", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6868f070-c973-5179-ab83-b858019adb34", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7b4ac63-415d-5ad1-a475-35fd7ddd4ef9", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:306a4152-c704-5196-a0d5-7dd58f16b73c", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b653d5e0-d1f9-5152-95a9-dec21c19d275", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4017a279-77ae-532b-ac48-a001f9430b7d", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9dc6637f-35ba-55d3-b14a-67af2cfea79c", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5819c373-12e1-5fd5-86e5-721f633bfa3f", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@4.2.9.RELEASE-tuxcare.5" } ] }