{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:57f6e5aa-e7ef-5b4a-a938-c38f84cff190", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8", "version": "4.3.30.RELEASE-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:45bb2e4e-fb94-5135-adf9-4eec19e2897e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:5f8b5e0c-c19d-5712-b852-9f72a8ab7ba3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:29c09384-ece0-5fe4-8de1-913a6657342e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:87833864-ff9d-5259-b84f-a2e8d75be0f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:d0426215-ee41-5b90-9b60-e00ab87f36bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:8fb77776-0e3c-594b-82e3-2f4930d8ec21", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:e38de019-37cb-5e7e-a7e8-31a70c5df580", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:604c70db-61fd-5182-878e-37609a40000a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:c240ef23-de30-59d0-933f-f5fc1cbb80ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:d012d9cb-ec8d-5e85-90bb-71192bc5ea81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:7be42f6f-15af-51e6-b487-8ffc6e042105", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:dfe0c04c-fd30-5a56-b91b-8bc928b3a3ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:4a4b4acc-c510-5b2d-8e52-f548a110fbac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:52924412-348b-543a-8341-8b3a53a305b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:29085a4c-ad66-5de8-8fd1-0955121a7741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:c52c8a0a-3e86-555a-bf2f-a88378137737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:e7f723f7-bec9-5796-9686-f2ccfd24ba19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:d79aa1f8-c426-5eb8-ba07-739b4ec194be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:bd688b31-4d34-5129-a84c-e70df116f06d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:0efa8906-d821-5c21-acc0-68ecfc0668c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:a04f4925-fe9a-5dcd-bf1a-3f774aae9c0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:1a010601-cef3-5f7a-b755-4fc84e9d02d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:314f8003-46ec-5ab3-abaf-487c6ac503d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:dd8676cf-9585-5e35-bdbd-8c723ef4ef90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:29346935-5076-5c81-9d77-fd92f94e6d38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:ee04b10f-801c-5532-8e0e-49a645fccf9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:d62c59b6-d902-5cc6-be2c-81dc9b914e30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:b8929e58-8a8d-5b91-b433-917b0e3ae3e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:e39ac200-ced1-5964-a4ca-79e29385e350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:903e0d3e-8247-58ca-a539-413ae3b987c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:1d38ae98-cfd9-52ee-b5c3-c1f65c33caf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:9e8d6311-5019-508c-a79b-d4b592f378b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:cf344f16-8c95-5aca-9b1d-d673aa23dd68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:4903ca69-19f2-52f1-9e0c-c004c0b4284c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:e99f9ac6-9027-5d36-9040-a43b72d726fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:d7453a2d-506f-5823-92a4-6ac9073117f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:c3a3ab12-f1cf-5fdd-a698-d0132976e566", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:d3cccb5a-08a1-50ef-b50f-175edcee0f26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:ed638157-14f0-5bed-8daa-ffe097ce0307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:563592f8-3298-5b31-9d4a-6a5a7bc12ac6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:90855a11-c56a-5054-821c-adba375e5ec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:59554681-6d9d-55cf-a901-8b8888891eff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:8f5d0117-f4e2-5c1e-9078-34bfa0d436be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:213927d6-9731-562d-8b31-86bc51a11621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:5c1257a6-afb4-5fb7-8df3-98d892e858f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:075641a9-5c12-5798-9c66-4f4c0dd09cd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:38b1aefc-6340-5515-b853-5ba300bde509", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:0575c821-83ed-5eb1-bb44-ec395c2f220a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:2839e316-dbae-518e-bcbd-ce43a4c6bff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:e5dd02a7-596d-5208-817f-e0ced118d2b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:970baf5f-1ede-576c-b757-8e9d352cb655", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:14a3966d-2870-54e0-b973-03228a60d11f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ], "bom-ref": "urn:uuid:465df746-660e-5f98-a923-d5d3dbba3666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-core." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.8" } ] }