{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3101b9c2-e91b-5891-9943-764b953d5fba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8", "version": "5.3.27-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:4b8191aa-5958-5020-8255-1a2d878df343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:e6d4f5be-8694-530f-9bf1-7d9495205184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:30f8abee-4db2-5065-a1d4-400015deedee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:9908c187-71e1-57c9-900c-f29bcdf16751", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:e17dd0a8-d152-564e-a3d3-0cb61146880d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:0660d0cd-fe3a-5a37-97a0-2ee76e5b94b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:e3b13a57-682e-5d28-a51b-6efa94a054cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:7622c706-90ca-55fc-8bb7-4ff812ff2a92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:374b1f2b-0b9f-5267-bf8c-c2d8627180e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:ab72f243-281d-5361-b6fa-e4ba10849373", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:a432cff3-fbb5-5439-a5fe-73667e8e2cc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:47458549-99a0-5913-8d15-fe0879c86116", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.27-tuxcare.8." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:c422fda4-4211-5476-867f-1ec93d4257cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:b634b680-8c8c-5e9f-9626-a74216dd1065", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:3dc936a7-03e4-53a0-bfce-7a3fa3971afa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:dbbd4391-ac3b-5c8d-b9c9-d58c5120fe9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:5f23b06d-23b9-5e0b-9a79-6de8107b3bd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:30fbe995-e495-5758-8afe-a7e1a7ea7b4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:804f33ee-2d6f-52f6-9310-a7d79c734244", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:3f948234-cb27-52f2-910c-096ba2d1bccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:3060f372-7903-5cc9-a835-07a9d2fafaf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:1974e675-79c4-53ad-86bc-4254cc4a5c88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:7a9647ab-df27-52e9-b17d-ec3aaed40efa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.8 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:9a9ba345-8bc1-5ab7-b263-c8396c419f1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:e66cce88-5a93-5845-b83e-263c8878364f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:bc82a141-5da3-5735-a7cb-bb161da9c942", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:58ba5ca3-fe30-5ac5-80ef-9cac5f08859a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:fd300ab6-aaf8-5eca-8c14-4edf0fc89854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:9467255d-b353-52d7-889a-bf8152213c28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:a618a1a9-505b-5cb9-b424-af7186146509", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.8 of org.springframework:spring-core. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:d4d013f8-788b-57e2-8c47-5777888f7f6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:49e3fd54-6eb6-5fba-a05b-133fb74cffaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:74e9bac4-9240-5af7-8ee2-bf32f6d13511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:c8898519-deba-5f35-833e-a8d418b86f2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:7afbf6a5-497a-58be-824f-4e7a7618bb80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:d6cada13-2d5c-5dd2-9a37-deafa41c5b58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:00083d50-5e89-5f33-87e3-6a226497771c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:7dced4d2-699a-547b-b6cc-909bc143af59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:c842a2d1-af5a-5898-8f25-fe4db2ab2207", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:354629b3-e786-5cf7-96c3-7485d962f85e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:eaa2a1c4-9b67-586d-b3fb-30ad72975a21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:da6d8855-1bb8-5937-b706-0f6435bb1492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:eacc08bf-7e51-5965-a9c1-8c023c6c7492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:e4051e02-77c4-5dcb-8d55-f1fbebf37775", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:08d17a92-c4d1-5519-819f-2121d1c3af5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:b9a4af5b-774c-518d-adfc-a846d5bcd97f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:f2cfc5f5-2232-5a77-be40-890eae40bfc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:fe6babf5-9f07-5784-a2bc-8752b98f099d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:4d9ddf7f-5621-5503-83cb-dc1d6dee8957", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:5da4c662-6134-5abe-96e3-ec16418ac4d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.9." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ], "bom-ref": "urn:uuid:469154a0-65de-5380-9539-5c5f82f71e1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.27-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.8" } ] }