{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f29439f-2e99-593c-9bfe-55645b8ba4e4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10", "version": "5.3.29-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:d6e93332-86cf-5ce9-bdbd-523fea2003ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.10 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:269d2cca-30ce-5531-960e-e7c72ae29421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4849f00b-59a5-5b1c-aacf-debac83d1be8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:c7ef9ce0-f81d-5c55-9c88-07929b6564de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4127752e-0769-5ac1-b38e-fde592febc4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:c4c3357c-43a4-5ba4-bb57-f95b71660621", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4aff46a6-7f83-591f-af7d-9e73abdcb4a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:f92020b5-7499-572b-84e6-c0c43e8c0266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:d0e5c3d8-59bc-5344-9f24-d1a2d96abee4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:e787debd-a081-5e92-a595-e0a413da2f46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:2806e457-3ae0-515c-8b6d-a0677215f747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:208b4e8c-0d90-5991-be5d-b58ff8144add", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.29-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:ff06d3b3-4ea4-5095-9faf-11b34dbdd893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:2a32b1f9-6af0-5858-93ab-28651eda1939", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:9e6c4a2d-977b-5bf0-9eb5-9c4c3ed2e93d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4941d1bc-ce2c-55fa-bc17-73c4ee36fab1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:755ec3b3-cf10-5cb7-9d2e-6f18691ab471", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:91e6fc18-912f-5da6-96ec-c8014d216556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:42e9b594-6e11-54c5-8a79-0035be7db706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:2d7480e7-35bc-5611-a6db-95f2761c5a83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:7da72fa0-a114-5628-a43b-4ef95b53c638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:df65d28c-1994-53f8-8ede-d69934e345fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:31f87a30-cb0f-575d-8c41-1459c1864dcc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.10 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:91da63ab-9657-5da0-a35a-ff85972b3c82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4fdd3340-264f-5bf0-874c-71fac76d4a5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:06de62e5-77c6-5823-b6df-613ea1442551", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:3a0b605c-ce79-533e-bf10-7ecbb0e745f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:b394576e-d2f6-5dde-95d2-e3d80082f1a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:5aa2d501-422b-5d1a-b242-00a3c4948b62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4d25ecdf-751d-5b1d-ba94-db2081fc4d1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:edeb317f-a54b-5398-94a3-ecb54d149811", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:4bb00928-f818-52d4-8310-a7488d7dd4c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:80d2f9a5-fc83-5e26-888a-27795f425a49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:0859aff3-430d-5370-8ec2-6182f8bb8bff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.29-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.11." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:7ac93c83-13ad-5216-a5ce-619de1c313f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:f81331fd-a298-5dde-8733-f1eef2e4f9c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:e6e9481e-f1f5-50f9-b0ba-47e69eaf284d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:d4bf43a6-a1a5-590f-9961-317857c93455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:ec15befe-9954-5d29-a8dc-c6fb1f7553f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:3a1d121b-84d8-53ae-9f98-59373c90bb9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.29-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:788fda3a-e39c-5f3b-948c-eae19f8caff5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:8b6199f1-3959-54aa-b428-bc98dee6b77c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:6030348c-f195-55b2-995e-76c57b3ca245", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:e130289a-fd9c-5d92-a393-970f343ef302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:c3556bb1-23fd-582d-bcc2-30c8d64b39e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:76500af9-fa82-574e-b5d8-499b45d478a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:ad3c74ef-db5c-5a2a-82cd-a3b8918d813c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:e0fd9d22-44e6-52d2-97fc-ebe020fc6a3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:5f6e150a-36e6-5ebc-a4e0-f7172630bd9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:bb20812d-1dfd-5558-8f44-d56439b23189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ], "bom-ref": "urn:uuid:2c7ddf25-f27a-57a3-8ec8-c79eeadbed0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.10 of org.springframework:spring-core." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.10" } ] }