{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d8bcac2-69de-5c23-b87a-004c03cb93af", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-core", "version": "5.3.27-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:211f39b4-6f0c-5666-9c5b-97db487a9322", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6078fef8-35f3-54c6-b854-25f8b06f83f2", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b340aa96-af83-52eb-9a16-01a42b16c83d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:057f5429-fa48-52fa-9e41-f4b8a9cadd16", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:10a0dff0-3d3e-5a28-afaa-45e66c4125fb", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ca020a63-fe60-584b-8487-d0a2fc4e7382", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a87b6ddb-7cc1-5682-a814-0759accd1016", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0e7ad330-a4e2-5ff5-80a4-e0614ed2740c", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8b95d6ca-32f2-5cf8-b1e3-4b7a2252400f", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:68a48b56-de0b-55c4-8ea4-1bf908154ec3", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c584623c-8c5b-552e-9b0c-445054f4b64f", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c4dca41d-7afa-5d7a-93c3-1e1054fde839", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.27-tuxcare.7." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e1cbce14-1a83-50e5-ac1a-eddfd23f428c", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8cf2aa75-3745-550b-a5d5-9186dca3e916", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0db615b6-6f92-539e-8915-1269ff408bfd", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:55a841e5-0758-5061-8043-40dd0b845590", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b5279654-0941-5c9e-b15d-348127e27e24", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ab59a2f5-cfdb-55e7-b743-9c25b998ad4b", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f0478133-ba59-5d31-ade9-1140aff3f224", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f4d03341-2082-5d0f-a51a-95937fd3057a", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d1b9d0af-8136-573f-aad8-6b15fd590b37", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:867e9abf-748b-5959-9909-4814a6e0724f", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e0b7d7e4-9cdd-5a81-b1d6-93cb97540361", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.7 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:47fd72a4-2f9f-5c06-a859-e62870cf322a", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0bc5c05e-d0ca-5c8e-9d6d-52375d667189", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e5075f04-a9d6-500a-bf97-12f6ba427028", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:bd0e70e8-ed2c-593e-b9b2-57dea9a09cd5", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c535c28a-2474-55e5-bb98-9dffba85e487", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ed002b9e-a9dc-5851-b73f-ff21a398ad0a", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:afd4d09f-594e-5b10-bbf6-e8ac4ad5c82f", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.7 of org.springframework:spring-core. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:06b42e6c-0e5e-5a4c-a05c-63db70778df0", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9b4f501b-4a54-5b18-8ddb-778b8353258a", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e254941f-8557-5f83-bf2f-0c80252b5498", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cc4293fd-8e9b-54f5-9726-31441e93b7ae", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e6358626-fff3-5bd5-9674-c0a868b99132", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8dfb0ea7-b41e-5c55-a145-0bdb881d50df", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cf06bed8-79ea-5df8-b754-8ab41bf2eede", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4fd1f2e0-1f29-5dc0-91a4-42ea458eb48a", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.7 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.7" } ] }