{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:534bf0c7-f92b-5043-a335-6c4a5bf9d43c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-core", "version": "5.3.31-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:db044d46-a260-5aca-bf9a-9bbe8bc53d03", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0f0d52aa-326a-5bfb-a490-75d4f9319024", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b7a5df73-1bd8-5406-8a11-46d4aceb25f4", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2fa09bef-f005-5488-bccb-d73559061e05", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:19740523-7ac2-5404-9139-b14e0ebbd54d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5af0f7c7-8f0f-5245-b69e-62eaa5cfc1cd", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c6fd092e-1f58-5e46-8979-7c3ba1b4090d", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ef60eba9-9ae2-53fc-bc20-184da44ec7cf", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:dfcb6727-dacc-5c20-a9c4-080248ca2561", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ffd524cf-468c-544f-a709-8f48f975f80c", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ce80655e-b84a-5321-8e6b-cd28b9b13bb2", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:922e73f2-519f-59ef-91de-e4e592d94cba", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.31-tuxcare.8." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0803a148-d997-59b7-8031-e67f202e4f1b", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:471a3216-aa57-52cb-9f6e-a88afa6f467f", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:eaaf37eb-5398-5e42-8d45-7945c36d9739", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4e907e96-63ec-519f-b1fd-8d070ad8f536", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7e881816-f084-5724-bcce-05c7058b6e0a", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5828650e-81e6-5b71-9ab7-fc7e06f70a1c", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4a1c155f-93b1-5298-a0fa-132c54bd3a2a", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f13ddd94-1a69-5240-a3ca-cd6b3a061ae0", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:73645b7d-4569-5466-b48c-923efd20407a", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:50d618fc-177d-507b-a132-8eaf75e28874", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7c5b58ef-9fcc-566c-93a8-7e2901f9c902", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.8 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1a7ef96b-23cc-51a6-9e21-f7d7d9691eed", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:93d79e19-f2c8-5511-ac00-30a69aa6abcc", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:179a21ef-c447-529e-9e7c-9b186168eb50", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:150ecca5-c652-5a46-8fd4-a7142561c0f0", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:789731ed-ad63-50d1-b687-1fb1e7dbe8f8", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5c2d2254-58a0-5d2a-9ddc-53df5bb5a374", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:18605dec-bd21-5857-918a-67b54d4ffaa2", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7a790b16-751e-5797-baf1-34fdb42e781e", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ca39c36a-af8f-572d-affc-9fa538a85f48", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a0e0f6d7-b40b-5ba8-84a2-55fbb6b8966f", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c165056b-0f56-5246-92a1-5722cfa28268", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:79d54437-d46e-5cb5-9f7a-ea581160e09a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:23658c00-3e93-557d-ad9f-076084146b32", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:84938a60-18ae-5198-9b57-4c5f9d333ed5", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5033f751-e3dc-59ca-bf69-7ad67cee37f5", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-core." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.8" } ] }