{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:273200ea-c8c7-5c84-aa69-fb2cf76a765e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-core", "version": "5.3.30-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:41bf5c40-8b46-57e9-90f4-78014bad27f2", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:01cc6a1a-be6b-5ccb-87ca-2f736ce71041", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:adc7b118-cb0f-5798-af62-c83de39028e7", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a1a66cf-8f20-5ea4-874f-7add5dfda6d2", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b933b79-87cd-5d70-8232-5ebfd94abfd1", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f5243c5a-4124-5012-9a6a-01cd10433ef5", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:980460ec-2709-5c76-a8cc-2c09519a12eb", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:395bde90-761e-53a4-8784-7462b54a1a91", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a1bb5097-7fba-5300-897b-43eb7e85e9de", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c157ea09-3f33-57de-a567-72f85bb3ec02", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:373aa1a9-b1c7-5bbc-ad60-0616d5eb107d", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1c46e458-d0e0-56c7-b7c3-ef4f2d337164", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6acc8cf7-50ce-5b5e-827c-3b9a587d12f5", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f7170d26-6883-5a5c-86df-5bb8f3f2ea91", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2e9405e6-b528-51f6-b370-a0b08aa08a51", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5812f546-1d14-5e00-9799-0d3288deeb1d", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:90d397cd-5ffa-5ea0-8762-e6c157a5a54b", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bc552a31-c6bd-5124-8900-a93c772a0cca", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:04f807cb-a27c-5dd4-8203-fe1748b9e108", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f1efd1cb-ca3e-5f94-9164-847e2b6e20e8", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:84dd0793-0471-549b-8488-874fb7e9be36", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:10138227-cf87-5805-b368-42fc488c7f82", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.5 of org.springframework:spring-core. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:28c39952-d652-5c01-9f68-9ecb5cf97fdb", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:86474cf8-bd80-5e48-b12a-7676878b1427", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8867197c-d738-50f4-bec8-e2a4b7893584", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a6e773ac-81a4-5fcc-9c44-747b41b1e63a", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:106d82e9-735a-56d6-9d96-bbc92f92ebfc", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1b4076f1-bbcc-5381-88ef-17974edd5639", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:973ce80d-a60d-5084-a081-25be6dfca7ee", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fb3d4e8b-0839-5e9b-934c-ef608066e271", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:38cd7e3e-a8b2-576f-a848-3c720a754471", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:39220f16-c797-53cf-8d60-aea67ff4b703", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e2b31efd-39eb-5623-9da3-cbb0cd7a6eea", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a424b0f9-ea79-591e-9cbc-b59eb4bace54", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4415719c-b3e4-5e70-b808-3bcbcdfa0249", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:765a804f-499b-59bb-83ad-67b859dcbc0c", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d595f84c-6d6f-5969-aa3c-cb6b73a62784", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.5" } ] }