{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e127c830-0215-5f1f-84b3-fac5f006e374", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7", "version": "5.3.24-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:ce740cc0-4b4a-5ec3-b22c-2a0bf303dcc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:0cf69ed7-9038-5344-a652-cd5942183bee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:8de55d76-a8bc-5959-823e-1899959e56c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:92dd719e-ffb8-5e76-99dd-09ce5829c4f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:f649e9de-d914-500e-b5c7-d390551cd525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:5151cee3-7e02-50b3-a8c5-ad41a39a7ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:c37eaba0-2977-5e5b-b135-75d9ee49d99e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:1fd0c388-e6c4-5e94-b84f-d246838bc1fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:cf9d2bca-183c-51f8-8318-69fc7dac7d9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:ec69594a-52a8-570c-ac8a-6092aaa6aea9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:06377dd6-f08d-58a1-a2c8-4a9b9cf0895b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:75ace2f7-07fc-5cba-8c91-2d2f774c64cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:c4d8afcd-301d-5794-95c3-a83c7114d715", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:8d352325-dcbd-5fc6-9c02-592c87f030ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:755b140d-b114-5168-bf31-d302c06f4d90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:24274056-f8d3-52bd-bcea-e24ede0bddd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:60a3caa5-adba-50f6-98dc-cf4b54e81f9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:7c81944b-0017-5511-9271-f5a55401f355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:1e6c2f1e-77a4-5a77-8482-93f9a220ac66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.9." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:d6d0875c-c4a5-5ebf-a717-0df6a9b37817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:15f91f79-2aac-5c20-849f-1a9afc460c3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:bf6f4d14-cf3e-5c34-843f-d942126f64eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:d474741b-d1b5-50b7-a8fe-0a4575e89b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:1d7d69f2-10fe-569b-bf83-7b2431f21670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:465843b3-55c8-5e6e-971d-0adf13ab1941", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.7 of org.springframework:spring-core. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:6503e6d8-1780-5ca8-9576-a0583cfb1f8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:18a875cf-41bc-5d8c-b634-77439ee82660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:54707ce9-b6e0-5b7d-b11b-505668b88bf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:24a155b8-9d6b-54a8-9ab9-daf1372f2378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:e79f1c88-76db-5e31-b2d1-fd08c4a4b109", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:e2d1345a-7fd9-5b0a-99de-76283ce488d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:d85e6530-724c-5f2d-a67c-9e00839eb2f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:84c12733-6d82-5239-9279-1464d7752ff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:1643e2ae-d6b8-50c7-9aeb-447b4ab479be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:61589b0f-e2da-543d-934b-6063c8a63c4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:fe538c4a-e209-5c29-a8cb-1c5b21df9e99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:623f6573-385f-54b1-8349-df2185c5b4be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:017b186f-c487-56b4-a4c7-9074b2bb2ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:17147636-2828-57c1-8572-cad4c516e5f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:cf3b992c-b542-5cee-b164-47c0b80ce92c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:af566431-562d-5029-a905-20f9b960f603", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:a82e2c50-7a6f-54f6-a224-997b3a9a65a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.9." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:077279cb-7471-556b-83f6-cb48b5cfd479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:3a554c8b-40e2-561e-b0d1-7662792910df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:563a7437-b6cc-53ac-bed8-a81296116434", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:083dcb96-42ff-5130-a6da-94cbc7ad1847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:0f77d0ee-990e-5d49-8e27-338fa4815eaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:9c76be40-25a0-5cbb-999e-3e2dbd831c5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:5ff1a35e-aaa8-5ae4-9976-73fad11211b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:703bee22-3440-565f-abac-1a9020c97762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.8." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:49b49237-b7a3-5cbe-85b1-f9daceb7f640", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:81fb2ac9-7e03-5776-8393-233b76550ad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.24-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ], "bom-ref": "urn:uuid:c43ade3d-99dc-5a51-b8ef-dabc0e151ff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.24-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.24-tuxcare.9." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.7" } ] }