{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:961e80f6-2c7f-538b-8a01-4f24ba11f198", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:01272c9f-8572-53df-bebd-9d7bba3d2e03", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5b4a93e0-8ec3-571e-bb68-1233d8ab8a74", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a6a763c1-f4f1-5931-811f-e9c1a7ec6f0e", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0891e206-bdac-5a7f-9b56-ec8285fd262b", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:319c238b-32ec-50c2-bec8-6f8e53d3ca44", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d2ae129e-81ce-5415-b871-69d10b638ebf", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cdb47e96-ba74-52b0-a9d8-ee47129b3f9d", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:519f0bdc-874e-578f-812f-aaef4f869e77", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:69332890-67bb-5d58-b479-0c5bf20dc0e3", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fae5f3aa-f9f3-5724-a3a7-0979a553f68c", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:05f0e79e-b7a3-5f61-bb7f-e69b0022d8a2", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2321a41a-b958-57cd-bc13-134d0726395d", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:603ef502-d711-5214-8514-0e99197971d3", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1c7ce2fe-ccb7-53b3-b190-3b2df2cfd2f0", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e0fb6f37-56ae-51cc-af63-20f688492a60", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bbf40921-a2cb-5513-966b-dd1ba33d61d3", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2ca426d2-2121-5ed6-8667-773f1bab02c5", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9d977edc-069c-526d-8852-b25397d827ee", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1e41024c-b2ad-5420-8fc1-ae63b6d464e3", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:713de226-c53c-5fc3-9110-1fcb8f6a986b", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d719e63f-725e-5561-a589-079327eb30fd", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8782d1d9-4e54-5477-91fa-877f27ff66f0", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d7578e62-dac7-5ada-a807-20f9b62d3991", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:513be560-df61-5234-b880-1b300a7ee33e", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f04240d3-792e-5287-b20f-50202c0a22fd", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4b5ee704-1b46-5aa9-b0d3-5d8f87712126", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a0784fcb-927f-5732-bdf6-a213c2e4f8b2", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f8073187-d353-510c-a36d-2458bfaaf5a6", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:76e37787-0e3e-5af3-a022-a86b41031416", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c80dcb2-5eaa-59e8-ae75-ae15edbf3ad2", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4de77314-2256-585e-9c90-9b7dd3f3f6f6", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a1988635-6e74-54bc-baf9-1e6ef535114a", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:250ddf42-62cc-5410-840d-eea27f2e4d36", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6bb408ae-ca6d-5dcb-a6c5-2061858cfefc", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:02627ff7-7bf3-5832-a9a3-63737c463eb0", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0b24cb3c-6eaa-5641-9efa-bcb6d1a00938", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ca5f1fca-5b10-52be-9ab7-04280be9efd1", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:638173fd-b715-5d35-be47-9cf2a5ca1a7d", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a2be21e0-fcc3-5c82-a892-f242c8fbb987", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:061e339d-5d8c-5937-a0a0-18476d5f6687", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c4fcf04b-31e4-57e1-9ead-503691af134a", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f9e015b1-d8d7-52a4-82dc-ea1b05765291", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1f1abb67-a8da-5fe0-8f2b-14672d999a48", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f894199d-c1f2-5d78-ac84-0bcca8e87981", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d0db15b2-4dbd-5ccc-bacd-add225d39ec0", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:64485d13-6ef9-567d-a168-ea0ae982d678", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@4.2.9.RELEASE-tuxcare.5" } ] }