{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e871f6d0-e0b3-5217-a7de-0043eca55ac0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6", "version": "5.3.29-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:8f6c2fe2-f142-5d5b-805d-4928a035aeb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:9daeeea9-daa3-5dd3-bba3-ca45681e403b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:713cb481-43f2-5c77-afd0-0b4cdf5b247b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:ac7bea4a-82f1-5ab5-80ca-56e4a1f12a9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:81a0f483-cf45-5349-aa66-2de10cd11678", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:05d1ed3d-3595-5f6f-901a-0c6298cafb09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:c1cd7579-aa84-59b5-8f4b-1ba1275b5335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:1f644a7c-ba4c-55d9-bb58-e3fd37a15314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:f58b8ddb-73f6-5b86-8e51-a309101c8a69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:44c4a072-4162-5ec3-aa76-28f4e87c86d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:a169462a-3b39-5120-9505-9fe1ff8ca633", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:d5e895ad-4886-5882-b156-9ece0645f6c9", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.29-tuxcare.6." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:b8ddab4f-9e71-5a57-881c-4c286a80a474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:1e97ee4f-325b-515a-9d93-4c9de9d882be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:3b7137ad-674a-5721-bb86-d1ce398aa519", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:21defb71-1103-5524-988d-44238d47b785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:71f0ffd1-a51a-5947-8b30-a76032964e62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.8." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:d01f713e-92f1-5bfa-b32c-656abe70576d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:f6554fb1-ec0b-55bb-a135-79ba65b2c5bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:56d22f2e-1b1f-5e45-b63e-3e3daa2d245f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:653e4df7-a5b4-5188-aa8b-53f7933fbb27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:9dacc1cd-2b21-5f83-8979-6d28457df873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:129fe80c-e93c-59fe-8a0b-9eb3e1130d13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.6 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:38f144ad-07e3-5038-b855-bad0ad731938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.7." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:3e25d00e-4bd0-586f-999e-f17a15c49898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.7." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:80fdc575-84e2-5863-b539-005c253c729d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:371566e0-79ff-5d40-a6d2-a1c3012d4475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:0b1b912b-2c6a-563b-ad58-760ca8a1c8e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:1804d3a0-1fa7-51eb-a9a7-922e537de01c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:965ca9ff-e7bc-5f54-b3ef-32f9b575e11d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:633cd6b3-1979-5d00-935b-546d9699f97b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:e870f61e-21e8-5d7f-b224-20686150c96e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:ecbd4477-25c3-5ad0-9af1-430e00f4ddc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.7." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:8e990d3d-0584-5edb-98d1-cbfba0265e87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.11." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:5b4c26fb-74e9-5ac6-8819-c2695d813e1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:45705a47-97e3-51c9-a2f7-275987d9709d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:ddb3ff2b-cba8-5059-94e0-bc4e2e0499ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:eefcbe17-17cc-592d-8df3-ba73455d13bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.6 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:79e35da3-15c0-5e64-a34d-781059055d50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:838fa33f-668d-5645-9861-adf9f03112d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:cfb2f51f-a9fe-5443-bc65-77e35e0ee828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:cae24f61-080d-5859-80e3-eaeb7c964eeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:93997dae-280b-5fbd-8356-a357a11a7b18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:0e0ad178-70c5-5153-8bfa-bd2d7209a46b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:3ada898a-69fe-5550-805b-15a1318236ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:1132956d-7cb5-57c9-833f-8b85ffd388ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:0b2f2c51-e515-5a6d-ab01-ab666b0bcea3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:55964d44-1d19-5c13-a1b4-07c438d82fc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:c5a43a79-c84a-54c4-8911-84e09e2e3fe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:98dfbece-0a5d-5db0-9803-076a93e4f776", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ], "bom-ref": "urn:uuid:aa7f70d9-2350-57bd-8aa3-b2b92a651979", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.29-tuxcare.6 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.6" } ] }