{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8141186c-f50d-5318-81fe-7ee3af62c27f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23", "version": "5.3.39-tuxcare.23", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:a770b0dc-bc0f-5cad-87d7-e4c5f8a1becd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.23 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:95753f81-2ebb-59b6-8f08-a5b4b9b870c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.23 of org.springframework:spring-core. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:d1d892c6-6d5a-528e-a7c0-c1fc158d8e65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:5c88a59f-a38f-55f3-a135-e2edfb1003c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:4a1fafb8-6e5a-5e56-9dd6-c8d27a614d13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:43721fe8-f931-5c4f-a5fc-5fb75626f97f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:3f6de907-1a40-515f-ac67-312e3484cafe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:a72d6e70-2fd7-5adf-a144-ea24f61a7547", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.39-tuxcare.23." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:87a4c805-9627-54dd-882a-103cfa08d32e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:3e139d57-520c-5573-b75c-bda5383c53c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:cbcd7cb8-b3d7-594f-8dee-227a1b108679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:9116cac3-ae17-5421-8284-cf71d050734a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:ed1f77c8-f80c-557c-8674-043ee4d3d8df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:bd2bd528-6f14-50bf-8235-9184f2f9d98c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:26ed1437-5a26-50bf-a3ba-c3fbb60c01f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:93ca0262-4843-5165-8422-0d6473d0b470", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:1cf099ac-4152-5670-b8e5-0c84cb647bd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:10b3238e-9207-5d22-80d3-2f3933c6dbdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:14da68d2-32b2-5e56-902c-a257e541bcb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:a7a8f347-b36b-5309-bf88-c5de8d0bb9c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:1a1422ac-ee6e-5334-8f9f-0b6585e92113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:fb92acd4-82c2-5acc-9b2a-0b6ba6d2a11d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:989599b9-04f1-5dc9-a620-7ae0c9b0b418", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:c97ba841-e441-5ac7-9705-081224a1a312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:1e02a674-085a-5cd5-a02c-28b7d2b5f24a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:4a910f10-cfa4-5558-9d60-03240f8e657e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:2ed89a72-2b29-5a1e-8ad2-824755a5387a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:4cb23745-a71c-561e-b0db-5326ce04c74b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:0e6115fe-4891-5a7f-967e-97d6873bf9c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:ae5c1492-ecf5-5cb3-b272-d7b216e6e79c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:46380098-9a97-5191-a5a1-fcbec2aeb6f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:8ef85ec2-8382-5547-8b5f-b4e513dfb0fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:ee627dbb-4d4f-5215-a7fe-0842a5de5b4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:136013e4-a51d-5b41-8321-1ecef100e59d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:b4cfce4e-575d-5bc9-87b1-bdc5b530c5f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:f4208c2c-7fd4-5284-bca9-b2568fe21fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:bad6cc18-7d92-561d-aab9-5735818762d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:981cd2cc-3380-5e51-b335-97fafdac5b14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:00cc6366-0244-5088-b86a-a5c519ee3443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:1310f5b8-395c-544b-9d7f-6eec7fb1ea1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:289a65dc-4ee8-5556-81e6-ed21d1f222bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:4cc7db38-cc39-51f8-b2ee-60d4a849cd99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:971ee4a3-fe3a-5772-8d51-1823622b7ca6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:abd1b8b2-4ffe-5707-b7e5-8930561f9009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:f08cdc80-9786-525a-b8dc-0be5576020d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:9f03ed05-900a-5722-9c13-01e2d2900fdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ], "bom-ref": "urn:uuid:0022062a-fefb-56bf-8d48-f28b761f507a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.39-tuxcare.23 of org.springframework:spring-core." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.23" } ] }