{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d4ef0cb5-d296-5866-9af6-5efa6a464832", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11", "version": "5.3.31-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:822d5235-4037-51da-8912-1b988fa1346c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:35787479-62d6-5509-9eeb-219319125cd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:f74efd1e-8957-5f08-84e4-17415a3c5679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:f7d4e26f-4e41-50c1-bba0-1ec76755c314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:5105c772-e147-5514-ad70-d24cafcd4618", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:079579fa-5198-5b14-9f83-9782ee8c360c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:6b5909fe-7dd4-54f6-9f20-06741729d0bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:e9d598ab-d4e0-55a0-b961-15254f32a9b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:89eab954-04ac-57cd-91ee-fb90aa59507e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:1783e5b5-81b4-5047-aec4-cb8382a032f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:e23f0c95-3687-54fd-9caf-3dabcb80712d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:3900c7d4-123b-5bb5-be64-93034af7f09d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.31-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:97b34c37-7d68-5eaf-9cbd-7a4ada82757c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:2144da6a-e76d-51fc-bb0d-46500882c734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:02fb3d65-4d5e-5b06-9ba9-cd84d1120c72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:a19ad25b-369c-5575-b895-f9c9bb0823c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:69b7dfbd-2569-5560-ab13-7f6faf3c44a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.12." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:19b45ef5-acf9-5746-8f1e-d9592671a38a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:fd218dfc-20c8-5fb5-9151-b66454bcb55d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:2feb95f9-873d-5be3-8df5-c226cf2ae5f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:25f919dc-16e9-5d56-9a30-ac2ede77f104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:ea8e6d20-7140-5b14-bf9c-eab0ce085e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:dd5007c9-9ebd-5ef7-a57b-34df41a10455", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.11 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:24829a4c-0eb1-5c50-8fe5-7b14ff8585e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:0de57dc6-5aa6-5548-8e6f-99255cbba48a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:a9d290d5-8096-5c6c-9108-2047ad0e04c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:1295f654-4e0c-539f-8b10-fe8b3f4207e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:76029123-de23-599a-a337-25527f08f88d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:cb7f0dec-cac7-51fd-92b1-2b18de875d17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:0bddd908-3071-525b-9897-6325aec1cce7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:cd99b5a3-c52b-56c0-b771-cd5a42469b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:69d5ff7d-fb86-5f94-886d-7a56604c9497", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:5b1ae01a-e134-5f24-b858-66666690f71c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:b9282c60-52ec-5027-9eaf-1db3e2c0db3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:e9d271ea-1bdf-534c-81e9-146c85fb6c52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:ef701973-bd67-59d6-88b8-09e3c7675197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:b3d42664-6fe4-5ea4-aa30-1c14a450d5ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:812ca386-3dd5-5667-8dea-8a0cc2102486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:0afead29-6af4-5de4-a7e4-cb5a6bfda763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:c62d02ac-8ca7-512e-b502-839a4f9da307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.15." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:2469632e-6e5a-5aba-8db1-d735a016fd49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:bd835ad4-0dd6-57b9-9367-949de00fd2c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:0d0d6443-2de2-5201-8e0f-ea79c70d9638", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:5777893d-a5a8-5b9b-b685-21f5aefc3f46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:0d2f3545-055b-580e-a46b-7e0a468dcae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:ed268882-6948-5c17-b129-dfdedd41944d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:76cf9e35-ea0d-5947-bbf6-3de1954ef05f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:12322812-2a8d-5b41-91d6-f03d3768d46a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:ccd9aeef-fbb1-5603-82ef-788ac03cdbce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:235d2a59-8367-5b56-87ac-088903594bec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ], "bom-ref": "urn:uuid:0e7dab0b-be10-52e5-933e-3daf0356b1cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.11 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.11" } ] }