{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d9aea384-73ca-5740-bac3-d1720d31ffb0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9", "version": "5.3.24-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7f59945e-174a-5d47-9188-b0ce6dad1dc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.9 of org.springframework:spring-beans and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ceca6af2-6699-5ef2-b4d9-cf002224dd3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:cdacac08-3298-59e0-bb4d-d1b5182487a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:59ebc1cc-d8c2-5d3f-a0e5-9ab214f6ba2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:3d41bf60-4f59-52ff-8aa8-f9afcb137d51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:19473c18-2de0-5e76-8d50-1afe07dcc588", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ae8d0b99-f30e-575e-bc51-c7b5aaa07441", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:146dd435-592b-51e7-8416-3985924d463f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:331ef580-ab9c-5337-b206-1e39e6389ebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a3af11b8-3a5c-52bd-89ba-9fe1289cc55d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b2dca605-7e13-5c94-9873-5b475fb819e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:9981f106-2c6b-5f57-91b9-17a3175333e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:509941de-b67d-5e98-8256-7d8e4c214a8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d68ccfb6-943d-59f4-a949-c7e77d7b2aa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f7f4d4fb-5871-571c-a6cd-636d4276cac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c0240f1b-f4fb-538e-baaa-842b4cf9a071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:981a0f13-4e16-58ac-b6c7-818f5396053a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:12bba20d-3045-54ac-b3c0-477bcd484704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:9c647233-16c8-5ab7-9fbe-da86b441e8fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:621a2d5f-089e-5578-976e-a7d359bc66ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d37e91fa-434f-5514-833b-712070574522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:708afed7-1720-5f04-944a-4d6a2dd8da73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:1d07ad40-b1db-5aff-be32-36c055873579", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6227aa4f-a259-5b02-ab86-e0b20047c2db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:16fb5f71-e497-5eda-9d94-42d810f600fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-beans. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c0966e5a-6fd6-5c29-97f9-1cd38fc82721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ad94330f-787e-578b-b608-ee3e6288a80e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ebc7df93-f7f5-558a-884b-de979e1ed506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5c469569-4aa9-5ea7-891a-151f39968143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:687019f3-53e9-5dfc-800e-2be0180d9809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e9bd738b-6354-5b82-92a5-57fc70334be4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:62d208d5-1546-5648-b040-d32487345220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c4e2059f-160c-55ab-9585-31f937373b69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7db206ba-0af7-503e-b224-99018f88a556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:86c28a75-f6c4-5a4d-9925-786322c18062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d9cd27c2-e29d-5af3-a0ad-01478734d292", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f9b019fd-ca78-57c6-858e-859d161b9d18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:646dee19-a3fe-5c1d-89fb-51cd3121e246", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:24ff4281-7281-5632-a97e-46040dcbd61e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:330ee248-03e5-516d-8f28-2292cf343e77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d2c82161-62c7-5448-a8aa-7bdfd50f56af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:eead7891-0eec-5025-93b9-a8910f499b09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d2ead4d6-7a94-55a1-80f9-3c0ae8b631f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:bc83b769-b4ef-5509-8df6-895759ef6f3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b9ff0ef7-f295-54d8-9e45-da50478a9daf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:68846026-5f39-5d0e-9d16-f75d41141833", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:94d1c268-3f32-51af-a381-5eab64ffb3f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:91bee4f2-67a2-581c-a621-e5f85fd65203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:74a0003a-848c-581e-81de-8896478486cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d6b0b242-38f3-521d-8caf-ad0a60f70b7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2348d335-2fe9-5ee5-a0c7-07d6f7dc982c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:13d1316f-6b5d-544d-8483-c003bfbcb5cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5d2b50a8-1768-55d9-87c3-a187508465f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.24-tuxcare.9" } ] }