{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:31f45a16-7b22-5558-acfa-ac8d95ea5bb9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7", "version": "5.3.30-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:1bb1d36c-bd50-5e34-b26e-16812e1eba81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:17bbe34c-97cc-5e89-acb7-6b42282b8475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:2e330612-deff-5377-9980-3a6c9160f5b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:6fad4584-41a0-5c0e-80dc-32f2ca70b260", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:8bbc6194-8add-557b-b278-62576b00d2e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:04f00380-8d3f-5e04-b3bb-d2da19c1eb03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:ae0f5563-57ac-5235-a311-1f167ecabd97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:98a8a47d-39f1-598c-90f3-97c154854a61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:2dc269ab-a1da-532f-bf57-ec0d5b2e6e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:f74ecd73-76ba-5826-aa8e-e686a15c9bef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:3c6ebd88-30de-51a1-a846-cd694c2a6837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:e9905456-9f90-5da3-82b3-2477a6b11134", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:cc60a078-9f38-59f9-a1fa-7f88b2298a4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:531994ff-e531-5f03-b15a-cc6bff7229f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:18b1fceb-81f7-59d0-8662-56e9a8478abc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:46d2273c-15b3-5995-b19b-d014c38a10c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.8." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:0576f668-9d9e-552e-aaf8-9e6094683111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:c86c374d-6281-54cf-9700-e393b239d8d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:9a7c090f-34f6-5f8f-b52e-7a30103e8417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:aaea5e04-14fe-5c49-8f3e-848f0bf0a9bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:a373f3ba-e271-55c0-b66f-b73df951e3a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:2ac195c4-80b1-5612-850c-e81a70539a79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.7 of org.springframework:spring-core. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:a9591851-7009-5719-8b75-b947726c9bb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.8." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:d95eb40c-d80c-5575-b837-66295cc30ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:c55d862b-90cf-5498-8212-c38b7258232c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:285aede8-6f39-5ac8-b71a-1441b635254e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:0b4508dd-e904-5449-a0d5-3e58dd7f3fa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:ae6ab872-35ed-5ee8-9c7d-cfae00f509c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:68ef52ef-2ffd-5b67-96ee-e3e0311a5710", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:29a86ec0-3561-5c27-9165-ab7e90344c11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:eced6d46-ecaf-5dfb-83f9-e86ad31645ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:a75356c9-5bf3-5347-8ce0-d6deb752a5b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.8." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:0d1f96fd-81e3-552d-a897-369e5ab4a261", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:8c184974-55d4-51f7-9606-10ddffb5e29d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:6fe94f71-0085-54a4-b3e0-93e096ba30f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:eb01c988-2113-5e01-a270-a66e678d750d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.8." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:2fdd9bf7-b194-5728-ba78-4acd020c4620", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.7 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:a1002f39-a25d-5997-b68a-af990398ea7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:994d074e-97c8-57af-bf6e-99ae95026b36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:d880578d-0fea-51a2-a6e8-46ee00bfa0dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:074e587f-f26c-5cb3-b746-a97feb4f748f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:989cd336-58d6-511e-96a7-13113b0dc540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:1e0edb6d-4fe5-5a4d-916a-574d1ac2662a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:7919bc2c-0187-5b76-a1f4-8fd81a400654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:b57a2d92-4059-5359-8e83-b82ab94a29b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:2b06a039-ae13-52b0-98e3-3847527a2040", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:3f733a14-7932-547b-857f-4f56cd5ee3d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:35f53425-e72b-52fc-b70e-4b100dc7adcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:61b7f56b-74a6-54d8-9e88-20dafc899154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ], "bom-ref": "urn:uuid:84cd6c8e-2e8b-5214-b7ef-06d269786fed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.30-tuxcare.7 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.7" } ] }