{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e56b8e1-2e24-59b3-ab21-29feffc28956", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9", "version": "5.3.27-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:2419034e-8c89-5d6e-a379-d943875b5be5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ff2df9e7-dbe5-59fd-8526-e5152518a353", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ce2697a2-3eb8-5954-b478-266fd7e33bca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ae485d17-bb4e-51d2-be6c-d1dfd7837071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:fbf9a9da-251c-56d5-ae3e-144ffc0fe95c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:3360653c-881e-568c-a550-29a1490eb5d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ecdb4366-ca7e-5d76-83ba-2f85efce105d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:8623d524-dbca-5422-8c66-1a56ae49cfd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:0f0f4d62-3468-59e4-9a7d-62bfbd0b2b0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:28f87c65-f0e5-5e74-b530-f511e26da898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:414bf938-76b8-52c6-b78b-218873dc4662", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:82195620-06fd-594c-a3b1-0e45bb3124ad", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.27-tuxcare.9." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:8b29d7cc-61d1-5e34-8c95-038ee2175add", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:fe57439d-1f83-586f-884b-149235a4866f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:1b51fd3e-5004-5a3d-8d6d-975de4f4b777", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:f1dbcfd3-47cb-5d2a-9a71-810f7084aff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:8203c48a-eb69-5fcb-9b5c-8301360efa6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:65aeaa8f-bec6-5c99-b103-0ec3154347e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:2e0613c4-937f-55b0-8b22-9c6f04fac429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:04f03630-d3aa-577c-bfad-0eacf267c060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:76fddafc-e748-5a69-8eb2-a76874498b77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ca9f15c7-ddba-57f6-a7b3-0c94c2a5af22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:1d18778a-158d-5af0-b783-0b4709ed27e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.9 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:fded531c-fcfa-50f3-91fd-5fab102d8947", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:e96ef674-c955-5190-8f81-c3adecde6b35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:af7f4662-4c57-5c79-94df-40c0f4a966c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ff127bf8-9e04-55e5-97bf-dc730b43315d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:7151a6a1-13a2-5fe3-91bc-969d123886a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:34e70779-f98f-59c5-aac4-95b877fa691a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:f0c5a81e-41f9-57b8-813f-6458addaa6d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.9 of org.springframework:spring-core. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:946a783a-de3e-5733-8e42-24938fe2276a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:2bc66c3a-312f-59d4-a6d8-1bc745ba99a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:8fcab4d9-cede-52f4-97be-1249d93c1b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:5ecd15b7-6082-5d84-acde-185385269567", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:47669062-d0fe-520a-9633-5bddbe654bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:a9da413c-5436-5bf1-8bab-ab785d0b2fb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:e6c15dfc-6962-5329-a4c5-189ef922b491", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:0875cbde-a6c6-54df-b9c0-b0ee3427c083", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ada49822-e0d1-5fd1-8bb8-398ee8d185ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:c026972b-8a5a-5bd0-b603-1251f835c621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:22b12c8c-4d79-5d3e-8ce5-868ea4e41649", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:00cb5c0a-8665-57f2-add8-45e202fb6ca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:45c36589-b2cc-5159-89e7-80bcb9daacc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:ca0239cb-5025-5913-a8bb-d9a2729f13c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:bde7ef1f-75d5-5fd3-91d4-0eb575a46c0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:75e684c8-02b4-57af-a761-a6a6a304feec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:d9ed1359-efa9-5ac7-9f45-f3b9cf3a1771", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:4204dfb4-3840-5b5e-b7b9-cc49d30b15ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:7016121e-8431-558c-85ca-832ba4f7c401", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:d5a09c60-7f38-54f8-9926-59b7e78bc19c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ], "bom-ref": "urn:uuid:1f056299-5ca0-5009-88d7-b54cb1ed7d7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.27-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.27-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.27-tuxcare.9" } ] }