{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9fcb8435-3abc-5de5-bdc8-5665d06281f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10", "version": "5.3.30-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:35e8916c-0ccf-5bf5-809a-68207a37c6a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.10 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:3b0a9d55-44c6-5b7b-bb48-d38e3cd22b30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:9d487f34-f78e-5c84-bf8f-a78a6961ff5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:6dbf43fe-64d4-596f-802c-2175f7ef2487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:0e68a05a-b50c-5509-b9bd-a6ab1f6bcdf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:493f8df9-6835-599e-8106-36fc7835cc38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:33462952-9f34-50d0-b3f2-47f9028059b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:ec67aed5-2701-589b-8261-52335a93dcee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:c83da971-e980-5263-8ce6-78c360ef4042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:a6bec7e1-652b-55bc-945e-2f3d1ca6c9dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:e26b4ea7-2aae-50a8-865b-687b2f5cdd74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:5d97d3cf-b216-5fac-a8fc-290c2080a9a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:4dd2bbf7-b0f9-5877-a66a-4484bf570d9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:b814fff4-76a5-580e-b1e6-c9b5812626c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:4780cfba-ef22-590c-a269-dddb38e61494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:c4b2aace-1ad5-5a88-9528-af30d0f3cfa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:7eb673b9-d02e-54d9-b73a-9ee9c0b98897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:7c62910a-e095-5d5f-bbcd-02bd09bad4c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:6c926871-d030-5e0f-90f5-7d0c469ebca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:923199b6-cf7e-596e-853a-7f46de8a4070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:f9f76fb3-bed5-59ec-923d-9880fd0b4d82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:e23480a7-de3d-5879-86a6-411cced48d76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-core. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:f6412ad9-c800-52b0-8ca7-d8e2e4953ff5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:51110d89-c325-551f-a54b-2cb56097995e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:3a0ae23e-16f6-549b-ad24-e65aa13cc710", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:56eaf5cb-bfe1-5143-8c33-b6e56428244d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:da34f424-6489-5d96-8442-72f52294a6a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:48868b7c-15da-5f88-82d6-fccadc1718db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:a390e0ab-1294-5082-967e-a1fae9e8ff41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:4dae39b5-8af6-5690-bfdd-930b24bd6fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:581ddeed-e5d9-59c2-8c9d-7f37184fa6be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:d9462567-b724-5c1f-9629-8ed303d196be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:6e25456c-9fa3-5526-88e3-5863a17936e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:624b19ca-f566-5c7e-b027-025f5c937e7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:63a83070-c5ef-54f8-8022-634acafe1c2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:efb0207c-e33c-5f48-86da-e08f61e3a998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:f1ee9627-b0d2-59c5-a864-53b2eb14e783", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:96bf521d-3542-5daf-8ca3-629f85137420", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:27c7bf63-8614-5344-8047-cce6363b4e50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:f254df13-dda5-5c7d-9dc5-2f89dc210c4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:4ca325f7-1232-512d-b9aa-c3f640c514d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:65f00e24-cf65-57b6-b6eb-7d3395593312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:ec9abf29-af07-5610-93ca-46b083ae47e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:244c4e48-3326-5e23-a486-3202508dee36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:d74de3aa-3c62-569d-8c5c-d2d35dd0ea41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:2f10070f-bdb5-5592-9c71-0e32ff599aeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:ea5d2deb-e26e-5485-a0cb-e4fefa4e4ec2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:f0edbd30-49dc-58df-8462-64633889974d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:2a577370-30e4-55bb-8e02-6fe089a402e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ], "bom-ref": "urn:uuid:f5a95814-0f53-596a-b298-1e181a87e034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-core." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.10" } ] }