{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dbece28b-3d1d-5d7e-b83c-aa40073a1b68", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8", "version": "5.3.29-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:5b2778d9-ab1f-5b89-8bee-f1f9b8091a54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:b70f032f-5b03-5c79-a06b-b76a4f8b066f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:9ea29002-5f38-575c-8738-d9e252405abe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:a7450011-8a97-5517-bee9-c975bacddbda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:81040b60-6fb2-5792-83ff-26f15b403114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:a5ac7c82-13db-5a1f-81d1-b88fc8cb4e72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:d010820b-b6b8-5510-bc6d-1f48e8f34448", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:eeb03952-38c4-5ed3-a960-5f7bccd5e35e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:3d4cfde9-6591-574f-a5d2-ecb9600f607a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:54122750-2816-5237-a05b-5b1cac8e6fd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:bd6a61c1-72e2-583d-8b17-bedf10d61d8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:23442640-8ae1-5bf0-8991-ba41066720ce", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.29-tuxcare.8." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:3a9334a5-47aa-5d2d-bd0d-760ffe9ee8fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:aa9ceade-192e-549c-9590-d98857e15f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:efa08771-02d0-539e-a849-8428cda9f15b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:e90fd903-fcaf-584a-b75e-1d065e298a33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:f81c5ccd-cacc-57cd-8d57-0981f0ab5af9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:a81e09c7-2788-5b9a-9c8e-8323f1df7e70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:fd25effc-9728-5ad9-91d0-f0b20cff7b50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:a2cc0f8b-36e1-5b2e-92e0-b99fab29c809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:abed12ab-2d5e-5f4e-845d-feabbf64b59d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:19cdce2b-7b41-5248-80c5-d54912860f3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:c7f5eba7-6800-5ae0-a219-2dca6db237f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.8 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:b8d9709a-2493-5a0c-925f-77708bee64d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:6a29dbdc-fa23-589d-a2c8-f80a155993ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:93bc4372-cbc5-5c88-9c50-654f5e106c89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:0f30caba-f0c0-56fa-ba91-e717dc3a3a37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:834d8724-f33d-5635-ab71-ae0170c3f178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:3bf59268-2483-5e77-a59a-3f7dea9dbcc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:c26a5320-d8e0-5246-a67b-cba97b317971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:491647c8-8eb8-5200-a394-2fd33651c8d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:eb74568e-a663-5451-a4e9-38dc9912d42e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:1be7313c-ca8f-58fb-9c58-9b561aac348e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:469fa26f-13ca-53d9-872a-3e2221a8f6f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.11." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:9d40e04d-52a8-5634-bf0f-ab4b6c5943b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:c9eb77ad-037e-5a05-bff4-06a35c2c895e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:2a09f49f-9140-5ec9-a97f-540871017686", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:e093e37b-f3e4-5d4d-8dc7-a7edb31be13b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:f0d40329-a94f-52c9-b9e6-6d913ce79096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:060ef9e3-d88a-5145-847c-2cfb703fcc43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:9e20bd30-3af8-56f8-9496-6173f8d5b213", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:b07985b8-b5cc-58ce-a522-7e79b619165f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:b5154bd8-8ec6-5852-bf35-fe70d9c18f94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:23213697-9e37-51da-8963-caf7c8b2034a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:1de4d5ac-5c6f-5860-8fe6-3538d61f6720", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:35c54565-6f6f-5347-895f-5d5afde68fe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:4fb1b491-0163-54fe-ad21-ea83012aff79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:85c2f217-e89e-5656-a516-a28f504805b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:92499e4e-b2d7-5ef2-a4d3-dfa891a591c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:e89e3c1c-399d-5ff2-afef-ac9100b77495", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.9." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ], "bom-ref": "urn:uuid:61ea4c24-970c-50bf-992d-fd265826d3fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.29-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.29-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.8" } ] }