{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:686bb98c-4fc1-54c8-bd72-f0aab19baf3a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15", "version": "5.3.31-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:fdc48eac-57b4-5ecc-8198-21bf21bba717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8dd6be66-30d3-5164-9686-c824425ec547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:0060c6e2-be60-567e-88f8-d5e8ecb21fc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f328b85e-df44-5a6b-807a-31e8a11d0115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:29b5af60-9de7-5cf8-bade-50aabd2eadb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:719dd115-89e9-541a-a413-efc27af70b0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:3e66d9a1-4ef7-5816-9192-d16e0df25157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:dbc963f8-e0c9-527a-a878-29e5e512be66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1d275e63-9c3f-558e-8ccc-d88b31af3c43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:71cc9ee3-0751-5dcb-b5ac-01de846ce430", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a8ab00a8-53cb-5ec1-9db4-49ef37a4e087", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:54c1a6cd-0257-54f2-b560-3bf0585460b9", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-framework-bom 5.3.31-tuxcare.15." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8d903c86-3d9d-58b9-80fe-34dd19d64156", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9e5cb356-d7cd-5146-91ab-a7102ff3d3cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1ede7080-eb91-515e-bb47-3d77e21c4d5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:e7243e00-8174-5f59-bd10-be1fdec76ff6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:166bbfa0-3e0b-558b-9464-ff7e7134565c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:13e7d683-f89e-5c69-9f7b-e6259184e3ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f7617e86-fe4e-53b5-956d-acbc79e3af92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b1b54758-fd89-5258-a44e-f98b4db2aae4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a741fddd-85f8-5b98-9d12-98a2f1107a7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f9133b49-784d-5788-aab7-98c22497bb5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f6494052-b2c9-54c1-9c6e-f35da6577898", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a88ea659-a723-5e43-967a-43f38c6f2179", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:0e5bf3c3-626e-58c2-bb0e-19d6b3ecec94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8056e96a-ecf8-5de9-8ce1-d2c1543a457d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:969e1cfc-c5a1-5bc4-b27f-bfa63ed50ebf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f0ca9578-813e-5a55-b39a-693a8aa88bed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:34660cf6-8060-551f-a951-304a40396c01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:7d47b447-d277-5b94-b11f-d031e76cfe9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:6b70ce43-a16f-503b-a583-46e27e5736b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:dd03ca58-7ff1-5eb0-b377-b63205bf9ad0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1dd900d2-b5b2-5661-95ee-ba60d456cb94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b8ef1522-27fb-52c7-a3be-8aad0d4c9480", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:7d7a7c7e-778b-5933-8cae-c52d678f9b76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5c8fc3d4-8a3e-57b6-b0fc-1611f2af2e87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9beda381-f0c7-59b2-8d69-b0d46a4cd857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a293729a-2520-55da-8bb2-b2853e400092", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:177450e1-f973-5db2-9200-a00e1d7b9c9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1ebd5e89-479f-5411-9884-e945915ebf77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4dbaa396-b4c3-5f15-9e20-2e143d468929", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:28122eff-a6cf-5584-adcf-8d021d879539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5859bffe-8d63-570e-b51b-b42323548ce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d6b6c30c-de62-5ac7-87a4-a46d9c9442cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:87d25d02-a5d3-526a-b3ab-cb189f0674ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c046cf08-6de2-53db-aad6-dd699b85e3cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:572f350a-7a74-58ad-868e-28931cca24df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a0eb0037-d925-59de-97f6-019f1fd586e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:aa090d0f-d71a-57a4-8d5e-96e78000d8a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d80f9adf-515f-51b1-8621-5180ef6b5b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:24229ba1-7207-5fe4-a784-0746213774cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.15" } ] }