{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:40e2350e-9314-57cb-877a-ed658d45cbe4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8d961bba-1fe3-5204-847d-c1a03a18a301", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f0ffcbe5-43b9-5ca6-8c24-0d2450dd933d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f5c1d2ce-2ff1-5bd2-a169-04dbdd2372a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8b77b1f5-4456-53fb-8b92-9b9f540a4254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:acac1c90-42b5-5f3f-ad15-fa20331a1f88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:59336687-def1-5139-b059-fbf031df9db6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0709764d-75cc-5d70-a4e1-3a7f85ace85c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0c34a757-eebd-55c2-9890-b486f3599096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:26d5d40f-5090-50a5-8130-bd0148ca6fdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4cd72194-43e8-5398-84bb-f2437b43f804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:74c2451a-ad4f-58b5-9232-ce490466f384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9010f7a1-5d22-58c0-9238-aabd3174301f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9374a632-7fb3-5cd6-89a0-e9a90b079141", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5e9b339f-9ca9-57c9-8a59-307bf7cbdbb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d3519f0d-6925-51fa-993b-722965012d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1e649e53-2882-559c-8dc9-211d566071fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a7e48f33-ec49-569d-9958-8465c053b0cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:798fbc7f-4ee0-5f02-8588-aa56cd5ffa51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8bf58d6f-4f2a-5104-862b-995d02ae4c65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c8020da4-b3df-5824-b304-03f64f2944bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d025b5de-2088-596d-8426-2431dcf18070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:422bb344-0bfe-52ad-9440-f503b33235dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f9bd9468-16aa-5322-be3d-ef8891eb2998", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f90cf401-220c-5d4f-821c-cb8596dabbae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bb69d9a0-dba3-5c69-ba01-218fbad0869e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f5151810-7b44-5889-8f4d-3f85c553cc26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ac43aa80-f880-5f3a-afc6-667703999887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d58e4de2-46ae-53d0-a406-2c8313c370ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2f4a2d5e-ea35-5a78-bd4e-d453be2e82c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:551c0248-df3d-567a-a939-a62cad66534c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-core. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b32c66d6-57ad-532e-90c5-19300eeeca12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:05e474de-ba38-5dfc-90a0-d2feee674b3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:89c677b9-29bd-59a7-b245-95cea12d7ac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cb1cdb81-768f-5530-8e3a-b83a758331ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ebe3e339-58de-5e2e-8820-4086201bdddd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:470579f0-8760-562b-b3af-b4e10f888c6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b39e7d13-ebd0-5f4d-8467-575e6dcbcbf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c718151a-a9be-5c75-957f-defd8db09995", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1f3a6889-21c9-5d40-aad9-2fa227f2b438", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8cc1498e-6e96-5f37-b025-af003f11f24f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1ead2869-cac7-5a9f-b888-124160faab5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2e86bd70-91a0-54fe-bf49-bce3f5c61b75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eedb44fa-3547-5702-b130-2c6af46b48d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2618e9d0-efc7-55f1-8cf4-4bb327285666", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fa6fa25b-4bb3-5e79-9e4c-d1cee9bead33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:acc166c0-f195-578e-ac00-71cec6c10348", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5e6ff098-a24d-5dfa-8012-c688bbe77b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2c6fed0b-3122-5fe0-a99b-1445aafbfd5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e86b7382-420a-545d-808e-9118eb8e5d46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6759c6d0-0f7d-5811-a650-862372bed4be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2fc53384-8da5-52f7-a1eb-be6348b135f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-core." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.10" } ] }