{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:209b648d-daa1-5d0c-844d-bfd40957d059", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21", "version": "5.3.39-tuxcare.21", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:ad93886e-730a-5784-a286-fafa1baf2057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:08fcabdb-49f9-5b81-bdb5-d82a14acc6e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:99d4ca61-cb1d-5f58-a762-4bd43cc66eb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:c1ea29d9-af9b-559f-94ed-319b7f241f1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:05d2e86c-0568-527e-9098-f4746c92fdcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:e5d49683-fbd1-5370-bd5b-5fa742fa7aa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:74fd3276-f090-5400-8e2a-30a930cd5aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:b12dc37c-2ac3-5f70-9160-847fcfc09336", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.39-tuxcare.21." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:0139b62d-0e22-5504-a9fc-a5638165ba97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:3554d440-8745-5cdf-8c88-c9001bb31a78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:0d9aeec9-507a-56cd-8c44-a0ff935fd7f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:3bb25fc4-010b-5e9c-bf38-c3e8d918ba5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:54ce5cd2-3fe0-5610-a34d-cef488c44c12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:dfdc0318-eb63-539b-b9a1-1f988e264e8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:0b41d415-7833-598a-b57d-a9d40f64ed93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:295fc798-a722-5356-b5e5-952bf9724d04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:41fb652a-cf88-5fd4-a392-4a810de30a1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:c41e80c4-9124-5900-8bd7-a0e21be38d7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:aa83e322-3b26-520d-b1bb-f34929341f33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:a8f3e706-5d05-5138-92f8-bd6894e84151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:6c195697-d203-5785-b02a-61f8f6e85018", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:94a189b4-48ca-575f-a37a-52767ab6806a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:acfc593e-d2fa-5bc1-aeff-5c2ebdc35427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:49776137-48ef-5b2e-b9ed-9f0d46b43178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:5db4ae43-03e6-5539-aa08-54cb858b8ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:8f2d5ac3-2301-5328-a6bd-bca18eb861d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:2c133418-b295-5962-8053-e7e19f1edebb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:4f89393d-8537-5638-81fb-7cb2ef7497da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:224c07b0-1687-567a-89f6-f6f6d009bfcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:d73a78ec-3023-5663-b9f4-823d21992c28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:6712a8ca-fdda-57f1-96ed-e283b9b6476d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:2ea5e42f-5650-5750-bf82-bb6afbd4fefc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:596b0834-9594-5cf2-b118-73007f6d73c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:6ea2ea8c-eb74-511d-91a6-4599b6199c68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:035398e0-70ea-5772-ad0e-292862f41ee1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:eac6965c-aa5e-5aab-8acc-558b38603e61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.23." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:a01fa039-ab3b-50f5-8403-d98778c9ef3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.22." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:65ad1c93-9826-58b2-811f-5af7f210acd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:0167310e-9dcd-519e-a38b-da7999cd7249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.22." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:1c7dc695-57da-5a53-91b2-f3b723e6f27c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:beb7badd-909e-5845-a6a7-15b5a5755421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:14fc637d-c54e-563b-b11e-06868796b3f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.22." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:a2a8975f-015d-5faa-8417-9a2952352d48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.22." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:db3256bf-0665-5271-9718-66c5b227b012", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.23." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:75237537-6b80-58d7-b97d-0cb4832a60a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:fb8a0dd9-fd48-5bb7-a0f8-7b637a7b52de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ], "bom-ref": "urn:uuid:809e3103-8d1e-5e33-8a4d-fad69a96808d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.23." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21" } ] }