{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bdd79054-704d-5860-9eaf-682768387243", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e3c2d3a3-3ad3-54c9-ab8b-6b6aaae42c19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1b9aa62c-21b0-53de-873f-58e08306f279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4e35eef2-74c1-5a1f-98a6-9227309062c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8aa3fbac-9e78-531a-8ecf-3fb5a61191b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ed4d74d0-f9e1-5095-bc6e-6c3fc7a70723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:deed5c29-8454-566e-9bf4-e7535871e135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:715501d9-4d9c-54c4-a42d-6adf0b423f8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:65512004-cf0f-5737-9a9e-a221880da11e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:138f04a0-172e-570d-93a0-b3413e426c63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dcfeaee7-6596-5df4-b020-e6c277808b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b078b9e7-60c6-5866-8013-dea0ecd49bc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:efa0c520-e523-529a-abd0-3f85c8a870c3", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-beans 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:633fadbd-12b8-5e23-964a-799ef37e3500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e674a9ed-4137-5a50-9f44-bb5bf8c691a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:69d21745-2c1c-53ab-aa0a-83abc5b59b68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:04d5ee1b-6cf5-55ac-a5a9-badfefabb360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:62a5136c-9869-5794-8b2a-7facfdd0fd6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a89c9c74-417f-5185-a6f6-27298314ed38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a8d18e19-22ff-5a8d-b310-e23a19def181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:71a858d7-2899-555b-a459-68da38da73bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dae72144-0a35-5892-b78a-0c21832e7121", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7f4646ec-b0e6-5938-aa87-e37d677bc40f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f701bc36-d59c-5613-a679-b44f475a38f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-beans. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d23abd92-5829-565f-9dfa-f8e9a610ba13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9f2bfafe-4c25-51ea-9d02-690c9feefce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:85ca7620-faac-583d-aca5-0b1fb4e27f9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5d4d228e-1e45-5010-8e96-271f0a2368c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:94063b8b-2d9f-50a4-bebe-b6f9a5519f86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bd4b4833-cf0b-5a34-b359-63c6f030b139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bb482421-7802-5e14-951e-66be9446f569", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e9e11c4e-7472-50f6-9001-568b76007bce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ddd57c3c-ed61-5fd1-a0cc-bee81ef17204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6bb1d522-2c78-5884-8a6f-c393299ffefd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a6bb1f36-d4a9-5617-af20-89f8bf6deb35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:09776ead-65de-5f81-bee9-85bf6d52a644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e61d1576-aed2-5449-9aae-aded87ba4165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cd29b46f-7b80-545d-9c8c-7307c7884797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cc99d030-7e91-5d91-9e89-5e5db140bfb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ccfe3bba-66ae-545f-a587-75c3b6df921b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:07686f1a-f9e5-5702-a2c9-8fea8ffb4c40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3244c3da-0647-5693-8dd2-96892eaca4e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b3964d93-448c-5cfe-8140-00831c43ba87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9e20b070-fd2b-552b-8b36-de68624f800f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6c5e7521-0ac6-5b16-9865-32198b11a022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:109c58ed-d2a4-559f-999d-894953c41072", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a07407c8-a32a-5fe1-8d5b-ea157f10a82f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:273369bb-a695-5dae-994a-547b05a714f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:89be7b08-4545-520c-a22c-2ca854d3aeb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8fee4138-0ca4-56d9-9930-0a3305140f8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c90acc53-23a9-51a6-9173-00c9efd2aee5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:91b185fb-e349-5f7b-adc9-e97d6f27ae6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.29-tuxcare.11" } ] }