{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:574d60b8-78e7-5100-8973-a539c585a77f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6", "version": "5.3.24-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:9df36c27-ccb0-5e35-a65b-31b5bcc34841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:f539442e-c6c3-539d-ab03-9834b17a7197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:30141413-5784-5896-8cc7-f796a8681765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:cf288bb6-7f4e-530c-a5dd-e0d7859e402c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:045c39a8-9ca7-50d3-83cc-9a29ce47ed1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:d46857ec-22a1-57bd-a1c8-175c0edf9e63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:7ab31fb7-0f3f-5d9d-9682-08c82adacd47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:0b316359-739e-5d68-abbf-e9cb7d46b283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:1f74c0b5-1e56-5510-bbd8-5bb79ba59ffc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:37c2cbeb-ab9b-5f51-a62d-a220602f3b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:9de275fd-b092-5032-90aa-314da2897fb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:fdf5ae75-ec9b-5c22-8e73-9d69f1b1a74c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:5156efb2-7ccf-5951-953d-00e78edd111f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:a7046c00-c102-5eed-b707-9e2fdd198661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:3fbe7a7d-98ee-5bf2-912b-93a46f4e9fc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:61b91846-98c9-52e8-a94c-6c93d5810c25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:1b1cb6f5-6cf5-5b93-a42a-7fd7b6412410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:f9d7b8bd-2555-5454-8d2e-f5ca920a2fda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:bc91eafe-6aaa-5dd8-80ff-a330724dc3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.9." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:dc17ef56-356f-5f11-96f5-8d4b0200d2cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:91fb2be0-c319-56a3-a847-79f95d1cfb43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:e3c1af2b-35ce-534a-9457-79d33dde64e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:a2f3b728-43df-5c02-ab71-a00ee487ff2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:a6d60c4d-93ff-5330-b84a-10945110a4ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:9d727835-347d-5fdd-9bde-2827d1b0d512", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.6 of org.springframework:spring-core. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:34aeb0e2-2806-5bb1-b3c4-eb87711d5617", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:1a39d1a7-01eb-531d-9ed3-b0e2d92c0717", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:20bf812a-6f70-5e46-a09d-bc987e95569e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:743cadd2-1a83-5d9d-a8cd-679b1a1c49c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:9e558f5f-716b-5f0d-8b4d-f795e2ab058f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:54b4afa5-751d-5d21-bcc3-86469ea44b5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:c162bdd9-342e-5e34-8797-61bd57330786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:4bd1b0ce-2b96-59d6-9394-6f9fab434aa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:a58ff045-5d1c-5d4c-bfb8-6a80c6f12ce8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:8ab5a48c-c11f-5856-b954-2eda31365890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:562ebd81-3ebe-5ec7-8a39-1d26775205cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:2bfe3acc-d32d-5ea2-895d-da57f48b6ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:83ec11e9-44f6-581c-bc45-2fe245fa1824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:91b8822d-a892-5743-992c-e02aeb826546", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:7a44e2e3-ec18-5071-81f7-e622810b66b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:718ecc2b-f185-5d8f-bdb5-38d5a6572317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:b6de9030-4905-560c-9809-0c013a9e531b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.9." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:0281abdd-d1df-5aab-8324-05ca10b3f49a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:f7ee2b5c-648c-5f47-acbc-530174c59d18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:1348713c-2a2a-54b7-aaba-9bb1808b5402", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:4e35680a-4b1e-516c-81ea-53ef795cd3f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:f497165a-af90-573c-80c5-9e6ec070cb25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:55d429a1-497f-5a74-8673-4d2a5b3869d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:b7b7c69c-aa2c-51f4-aac9-ace51f47ca5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:df57886b-a317-5563-a1f5-7c1d27e6e24e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:14f70323-dcdc-581b-9596-85c97db84ceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:d0882657-e2e3-52ef-9ea9-e5fdf9d1cc5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.7." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ], "bom-ref": "urn:uuid:8d1faa72-0baa-5388-84a1-47ffaa5222e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.24-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.9." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.6" } ] }