{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:59a3bb7e-2ab5-50c1-a794-4f76194cb064", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-core", "version": "5.3.27-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1f01ddd0-7997-5710-a80d-382a2e93a9d0", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5f5e9374-6937-5f0f-b737-4a954be38f0e", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c78217e7-002b-5a2c-860e-50a9a37c63c4", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5041cb85-43a7-5276-98e1-e75b41ad0ab6", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e667c5a8-45c2-5f89-952d-c203bddd4f4f", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0b677eab-cf72-5e72-b15d-d9db60cb0a81", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef50191d-1de7-5ded-a513-9dcca026f960", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:05568f23-460f-57a5-92af-3d8eda0300a6", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ed1415e4-d234-53d0-8ec1-b587b04a8891", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:adbd6761-39c2-53a6-93f6-071f3fbb5530", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:49dfc6d9-7ade-529a-832b-5946db3353bd", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c9a36a65-b657-5d8b-9b7a-0ef1b595ff0f", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.27-tuxcare.6." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2cc45447-37e0-56cd-9832-a13f31fec26f", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ceee49e7-d4ef-5166-81bb-fdf980cdca3a", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c758cc2d-6f33-5435-8d5a-26bce98546ef", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:685c82b9-d93d-5cd6-b518-c21b62dc85d4", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6def0823-f404-5aad-9c00-3afc30a84dc5", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:176a1cc1-17ad-56b9-a9bf-975591affb82", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:064177da-f0c5-54a9-9b74-c75b4c661f8c", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:56c89b75-846e-5539-b340-64f9c023fdc7", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ec2b279f-a902-5e22-acfa-7797e9db0968", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7113763a-4aa5-58cf-b66d-e10d88cf8ccf", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:06485a8f-c75d-5ca8-b4e6-9d317c3dd9f8", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:06bce56a-528b-58a2-a437-4fa7096b76b0", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d9f3395f-b12f-57ef-92b8-fdea74cf7d91", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d0cb3a24-9fea-5e25-a795-68b360eb4fb1", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f44edc2a-6322-567f-815d-6b12edb867ab", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5bc5456d-f4fe-539a-87ce-928fb9408348", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0ca2c589-c4c2-5968-94a1-9d292695c277", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:658ffd93-5385-52df-a372-2a1be4cb7632", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-core. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dfd351fc-b0bf-568b-bf5e-3845178cbbae", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7de65fdb-59dc-5735-a21c-ee298ee491d4", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5e4d9aa1-538e-5f0d-be6d-46f1ba9373c2", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:55d26b6c-61b7-573c-b5f9-0cc4c3614f7a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a4f3dc42-07c1-5b0b-ae25-d7e48958c2c6", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:091b6d65-7786-5500-a427-ec843831016b", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b5d467b8-9e5b-5af2-964b-4f304fcaa7e9", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:19b1192d-1af5-5dc1-922b-b226ae67665c", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.6 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.6" } ] }