{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:06245275-3c0f-5a76-b77e-3c2c8f99f8dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1", "version": "5.3.33-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:4a359381-8312-5c98-a199-4c69b9d3f737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:31786dc4-c52e-544e-aed0-5af0c4787687", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:fd78acb4-b1db-5a63-acfd-4e3608054e1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:8b6b1a82-6e86-5ac7-8044-6c573ef9b20a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6073aa42-96dd-523d-9966-7b4d8838838f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:df0b89a2-ed2b-5163-9db7-643af913094b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:bea5a786-e49d-5f8d-9218-974d8a7d5c9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:185b4ec1-191f-5b6e-a169-7fce585fcc8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6e592945-dad3-5425-99cf-624c4cc6a67e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:fc128c7f-2643-5dd8-8108-c4d658a48d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0d336a5b-a07d-54c7-818d-759da0cec1c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:07d0818d-f93d-5e75-9470-d790cd84546a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:dc970b95-34a4-5d3d-8b6b-d03b5da9038a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ae884a78-1e7b-52fa-bded-9e61245876f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6a0bab74-281d-56a0-b07f-95f1ec09179d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ea75d2b0-1efd-56c9-8336-f7db8e48a940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:fa86848a-7253-51f8-8f20-610e329b81b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:700f2c31-e44c-5f66-ac67-7210e43bb37a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:2d76d89d-0fa5-55c0-9e7c-aeeda8d062ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:7de7a918-464c-5e27-8b85-cbe629a8cfcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:577c40cc-cfe6-5d18-9d0d-ca69469d12da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ab67347a-b126-5915-973e-a3d84dcc0339", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f99a203f-2ce0-516a-8c10-5c0b235adfcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ad777df2-c5c3-562d-bc81-48e8718d3d3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a7546988-4b44-5d9b-9a17-b2467db3af8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a0e43ad8-19c8-5791-84ea-0b7a49fc04ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:008d879c-3c38-5598-8e6d-a0e18ee02791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0969053f-6d4f-51d6-a8b0-d79579051bd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:439f768b-dcc6-5ed2-9e61-4faa8892e624", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:b92b28a3-0e1a-5259-a46b-023b28a6a953", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6834adf5-2361-56a9-b373-d16db3f02ea9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d01aeca3-3a2e-5d3e-977b-f182e704a8d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:5d4a4f68-9fb3-5faf-a060-ff4ecdb45389", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:7da079d9-2b25-5205-8a95-fd7cc1dc167a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:be25f02e-e142-5193-a620-bf797f77ea3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:1e720f8a-b3ee-57d0-8803-4833f07ac793", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d08222e4-7e63-585b-9a05-dd68d4eb024f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:587ac20f-fd4e-53f7-ad3b-1b116b520e0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:45b308ac-b3b7-5fdf-bf79-f6280a1a4a1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f78b2056-3b35-5c86-bcc4-4f8457b9dee3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6cb5d181-75a6-5cb0-890c-af0600732c4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0f107ff1-e370-5824-823b-4280d8fa891b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:c5bd2399-1889-5a19-a3c3-15059b6972f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:96cb213d-1ec4-56ff-92c1-e85e7ef4995c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:64d8f575-46d2-5844-b1c3-f2100b973d31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:4c62c938-1252-53e2-a08c-45b9357f4723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:666ec511-e44b-5baf-b64b-7c4c13208d76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a2737dba-5b67-5d66-9174-c3f32900c88e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.33-tuxcare.1" } ] }