{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3dcdf4b5-add9-52ae-8344-9c13cd1af8e0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22", "version": "5.3.39-tuxcare.22", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:a3480023-7804-5102-be84-2894ec9784fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.22 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:ad86b0fd-25a4-5df5-9d33-6e4914b5163c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.22 of org.springframework:spring-core. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:a0a5345f-5864-59d2-acae-49c583e506c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:1bab2c62-e2da-596e-bfac-e02aa8bc4bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:ad74466a-792c-5d4f-b593-d3f70cf3ad9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:0a673a04-999d-5776-9f80-3d01716966bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:a61ea90f-ffe2-5d75-b6f0-6e0c0d89a776", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:44400e3a-6761-5c13-b193-b7ac1d9f72cd", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.39-tuxcare.22." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:060409ad-7667-5b8a-8c1b-a5371c516ddb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:33d89f5c-19ac-53fc-910c-5c422df3cc65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:91785eb5-6358-57dd-a67d-82b6cee8093a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:f51f8ae2-e485-558f-9e56-de962befd171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:2c1e1cd7-4cec-56c0-adcf-11528b17e388", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:32625fcd-c6c5-590e-802a-70ebb1073e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:f2eb309f-71e6-5e04-8327-0d2437458d6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:da9f94e9-9a65-5f45-8285-c22c3a50a561", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:72c42c8c-a8ad-5a20-a834-3665b16d7092", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:5a6dc7cd-3eb5-5300-818f-c631dee311ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:cc0fca99-781c-56f5-8384-fa7f0b61048f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:1302ad26-94c9-58cd-aa36-f8d40f5593c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:2da86194-5726-5cf1-bd26-7d5899e30c12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:1bcd8029-ddeb-5c93-bbb7-d28e7217abfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:d914e8f1-fe15-5993-9825-eebb6196d4ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:e5e1477a-fb86-52e8-8b58-ceb1215eb4aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:bda3ba61-5a21-596d-ae90-f65ec48b777b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:547ddddf-9701-5338-ae37-153d0918827f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:0b79b7a7-8db9-5013-a5dd-f30e522e0181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:9db5f69f-661e-5867-904d-1dfe7b455244", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:ccf64c68-f392-5607-a4f7-cc4ffbb98ccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:26aadfec-d79b-5a2e-9613-6de784691c53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:996c6df3-43cd-5656-9fc1-2f1c5cf5987e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:fa33beb3-bca5-5a2d-b0e4-b703d226b59a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:c23b6a00-762a-5688-903d-8459c0bb558b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:f03235f7-8f24-568b-bcfd-bec8b91d0b56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:6f8dd042-3b08-5884-8e13-75a10b3ff95e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:8c586afb-ca2d-5501-b9e3-d7615076dea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.39-tuxcare.22 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.23." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:6baf8986-d808-505b-ba5f-aee7e5d5a897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:9ea71394-9f98-5d30-87dd-43a442ee2a43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:76f8db13-2af0-5fcd-85c9-9f62679b5a26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:6663a5a9-d3f3-5a76-b93f-4f167cf5878b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:cce2c311-93bf-5fc5-a341-0e186a95851f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:64ddce75-9fa8-5e82-8b15-09f57346660f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:2d9f560a-8628-5679-80cb-74850510f704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:45aa0ba4-39e1-58c7-9487-8b466bd76ccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.39-tuxcare.22 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.23." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:ab226da0-82f7-5095-9897-c6611a119609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:dcd5aae9-3582-59ab-8593-848c6f52bf23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.39-tuxcare.22 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ], "bom-ref": "urn:uuid:8d2b3dcc-bae1-5b2b-850a-7b95bd44b795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.39-tuxcare.22 of org.springframework:spring-core, and is fixed in 5.3.39-tuxcare.23." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.22" } ] }