{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:445c4b68-fe54-550f-95de-8ef8d15dd97a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13", "version": "5.3.31-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:acb0ee97-0ecc-5e9a-bc54-983c865db7e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:fc76708e-4392-5964-97f5-d659c697bc41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:33e447fc-342f-579a-bd50-1cef8f95d88a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:4e8c3f45-2d00-5b2e-9f9e-5e1dbc781d02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:ea4a8a3e-a7d3-5dd1-a4af-332d1a780aef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:9ce58f96-6425-5927-8f17-a7f3d6a256b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:3b950863-be8a-5a29-b9cd-b32f68c7db63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:777ec085-9c78-5caa-bc11-75e5c8c2078d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:d46f58e1-7ae1-5790-a9d7-e1d763c0e218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:f7f248ea-2fcf-5cfa-a277-13ab3b69aed2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:d378f9b2-1f8f-5bdb-a842-71d251434945", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:ce27433c-9510-5e60-894e-263eabb6958c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.31-tuxcare.13." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:e1852b3a-eaff-5185-9a1c-8c6f664a916e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:bc7387e5-fc5a-5ea1-98a8-1e520134bee8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:853470a3-2681-51cf-8bcb-27592322f941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:629dc4ae-a238-5d43-8f18-ab1ff0158fc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:2f5f0cc8-60ff-5dec-8449-002970eeaf79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:4baf2780-3ecd-5b26-8371-4ce25b820319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:f15df8e4-8c29-5dde-97de-1c360686d7a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:6bdc3f6c-fd75-59bc-b2e5-cdb4d28c52b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:b1922907-1ea7-5a04-a38e-698f290a9015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:a59369f3-9bd6-587e-9e8b-1c450cc9a063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:c40b752d-ee27-5bb7-9459-2bf5c68588f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.13 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:4f8ebef7-7aa0-5052-8a3b-4f295bd0dbb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:209072e5-08c9-54d3-bcf1-020c548658e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:5e1b33a7-3fbf-5c13-a9b8-96ccae09306b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:b741cbbe-2d5e-530a-90f0-91e6578b21fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:4720a2d5-1b85-5f9d-b1de-498d1c3504cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:a55a4f61-f308-57e4-ab44-daf2a36a2a8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:31cf5367-b81e-5f93-b32c-7d8be50905c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:01666f1e-a6bc-5b94-9fb9-811aca24d080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:5db2fc2b-0e6b-546a-9082-c9bc7668c4e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:7626466f-cd02-549a-a7f1-d45c7a6ddd3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:485eb64f-c3ef-5f04-8588-91daaf1aad45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:aea5baff-2218-5d77-9fca-4bab0cdc87fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:52a4acd5-0f3e-5175-aeb4-6b0c5e45bc9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:ed3864bb-4b55-5350-adcb-6b8f8b813b0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:fec1fe5e-3237-517a-90eb-dae6968cffad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:4290757a-eead-5935-9406-5601007785e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:44b4ad35-cb9d-533e-8a24-cbe3d737fa3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.15." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:945e549d-07b0-598b-bc8f-41a4b4d6487d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:a08ebd71-ec83-507e-9421-41dfdd47cd23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:68b7942b-a720-50f5-aec5-cca0b99c0b4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:57d93c86-eb53-5e70-8cde-9a3005c1a86b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:f807db70-cc53-5156-86a9-e2b5781a95e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:b53a24db-13a6-5b71-8d3d-58466f5ffd82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:68cdac12-9a88-506d-bc83-50e107e9a5d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:21e2f0d0-54eb-50f1-b67f-bcf7bddb976d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:03cbc218-d618-59c9-b425-6ba609e2e765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:df1bf4db-dd3d-5173-a728-8a9a6034cf86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ], "bom-ref": "urn:uuid:d3f1dc25-5d18-52ac-b7f5-42868672d66c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.13 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.13" } ] }