{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:99b9f844-e1ed-52ca-9ca0-5f3522067d5e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9", "version": "5.3.30-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:9c215ea7-dbdd-5756-9de0-aa18aad15ad7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:ee899b17-dd39-597d-b31d-57b2cdefb82e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:3e81f043-7d05-5fe8-931e-7f28d47ce46e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:285f7487-d053-57c3-81ae-4f845837d9b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:056db5df-36da-571c-aea7-95a69354b26f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:14c75e04-1953-5bce-9edf-bf6928eaf3c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:bf39ea14-53cb-5004-b3fa-4eee5076a534", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:8d7ee6c0-4ec3-5765-a01c-0ddb0f55e716", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:14fbd8ef-a4de-558a-8852-151e50c09287", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:69a116ef-e563-5e16-86c3-1dfa98cc8a31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:8484c3f6-00a3-54d3-aa83-10db8062ccf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:3f33ed13-a6a0-560d-a065-ca560530250e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:4494228c-db37-5a15-91ab-17ac57392d67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:701c336b-6e91-5c30-a763-a599ed16f7a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:278b81f9-6f53-5467-9e15-6955901cf156", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:9e32fb42-3805-5494-b38b-a494cb44d0b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:46bab411-3583-56b7-bd1b-2801553147b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:4e7ccda3-d4c8-5f66-a4b5-59b3dae3742e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:3005c7da-8110-5f35-ab6f-dfc6af388102", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:bd25655d-35d0-576a-b05e-8d3a789876d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:56160403-9b6e-5551-b310-891b00338f10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:0287c15d-baed-5d40-b5b0-500324b34a91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.9 of org.springframework:spring-core. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:597cd2db-7c22-594b-bb83-aa8e8e24c781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:58e63327-c2cc-532c-ac5e-08da7b49d2e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:60d87804-5df3-5b1c-ab51-3deb91c9ef46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:28dee3d6-7a99-5f98-9016-b07c0763cf51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:3f0da811-d6bc-5d84-8870-b2a09c7360a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:e74981ba-671f-508e-a069-4ccbfdb05a88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:860c4090-a6d1-5488-bbe0-3990ef1251f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:329c7168-743c-5a98-aaf9-7c89a167fbef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:ed5c4a1c-63cf-5872-a271-bfa720a75c9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:ce4ad79b-8d83-57f8-93ea-f897722fb23b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:f9f5ec38-9cae-5e7d-ae43-fae453f800df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:d6fe3fdb-b13b-5e34-8654-3bb0e70512dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:0a09a249-25f4-5a61-9fe8-dd666b1e397a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:e0cc574b-52a4-57ab-a006-8161e32b0290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:7307209d-f4ca-5918-9225-f480faf84e6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:7977c424-5ff5-515d-a820-e9f383509d30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:5dabe063-a95a-548d-96d8-0fa29175cb8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.11." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:de74c73c-4fc3-55ca-82cf-168d0eb9ca4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:26dc9236-006d-5f89-8a2a-ed51273d0d80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:9b500a8f-6ff2-59e5-a1f7-69769d16f57c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:9b83fa46-eed3-5a3e-b393-f7ec0d0a4435", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:24992a6e-571c-5a0a-9007-964f82234b3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:5e956197-a25a-59ed-99fc-997e9040733b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:49a49042-00fd-55e1-9350-08a11dca94d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:b841b0d3-f351-5d37-9aca-7f8927011c2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:9c7eeecf-311e-59fa-8ef8-4b6f391dfb56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:06a912b6-ed46-50ef-bdb2-3cf50c08e103", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ], "bom-ref": "urn:uuid:6ce6d05c-5c64-5aef-adc5-5d2fb91c12a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.30-tuxcare.9 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.10." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.9" } ] }