{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5d444dc4-d7a1-5b21-9f5f-ccdcf2890cdc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8", "version": "5.3.30-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:2538e0d7-b718-54e1-ac96-482c58ce3650", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:72654759-4885-5eb3-a62a-ac41ca62c2b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:ff5a31c4-6769-5ed4-9999-0f4f20db85eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:93d83b9e-f358-55ed-b1a3-413e217610f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:9e1cdf8b-a9f2-53df-b709-03c838ceb6c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:53d02706-30d0-5222-938d-4ab14979dfd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:14b93236-b15f-53bd-b996-a3d676056664", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:d953f082-18be-5886-ad6e-7bff4019e01e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:26835c2c-0325-518b-a903-215b115854e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:fe39d410-8f02-5283-bc8e-d6c053b6fb31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:9e3209ab-3cd1-5bd8-a820-565694ad32e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:cd5ec41b-91cc-59be-b3af-b276ebda3dc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:c72a44b7-b22a-5181-976d-248062527d70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:7c902eed-012a-5bdd-995d-d9cc1dce5c3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:dba04e19-a91f-57de-a88e-369c1650ead9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:92bd50ec-efa4-5010-a3a2-acc4b0b9a65e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:f24766e0-704e-5893-a9ae-778c2df44406", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:40cf3d01-dc7d-56c2-9a0c-b644c0a87619", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:fda12fc3-fe14-5080-99c9-c52b57ac05fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:30179707-f8e5-5923-b45d-4bd690a836ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:abb09209-69ab-5470-8411-c5cc2cb0b056", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:f2fb1fb3-a789-5a52-9384-7908b750af58", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.8 of org.springframework:spring-core. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:24bf1b04-62c4-59dd-a79a-9ecb88943d94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:200bf3a5-ef5b-5f8d-9afc-492adb8e6279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:498d5473-c175-5d5a-b8c7-5913abb1f790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:8a85c716-d829-5cd5-b14d-987edb1eca54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:5d020015-7450-5bb3-9624-5d7a6a30820a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:73dffc3a-5717-5f7d-8d00-6b80148c002f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:a950c936-4794-5d2c-b165-806ebccf28cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:7c23238a-b632-5d20-bf44-e1a7d440b1eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:7406cfb2-686d-5661-a5de-108b5f5b69f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:6b7e8636-0b2f-538c-93ca-3c3f501c0693", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:66874ce1-547e-5cfe-b5b5-3071404d8c23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:e57f1f99-f234-58f0-97d7-22601e81c19a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:7617138e-11ae-562b-95c9-e1e9bce6a8bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:d613fc11-8e10-5a85-a89e-8901425e8d08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:62a532b3-662d-5aa3-8c66-a3367449cf8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:b40a8bae-0c09-566b-b1d2-0a85626d192e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:cbb94918-2583-5bad-9c7e-b8ac0a6cad9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:b7d4db65-5dec-5d5f-a229-dad87231ac38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:7c1f4345-4bda-5944-8779-a638174d31ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:9e53a269-0689-5d3a-9b58-8bec672cc27b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:1f48048d-f7c0-5b24-98a9-037ad3beecd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:47583a37-bc98-5ef9-9510-e6801177ffbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:62066f42-68c7-5f92-a8aa-402bf4dcf97b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:fed1f322-5717-529e-b506-72a7b0d8f2ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:6d21c3de-66ff-5b0b-ae9c-92e13666af4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:779a96fd-f619-502e-b8dd-7b81531bcb9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:450e6fd6-ce9b-54c4-9193-f033f3e154ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.9." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ], "bom-ref": "urn:uuid:08adda98-72bb-5d52-9e4d-708568da4b4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.30-tuxcare.8 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.8" } ] }