{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3d05771f-192a-58f4-9f4e-cc54e50cd622", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1", "version": "5.3.19-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:a1b2da3e-9845-5adb-aaf0-709743f1ca1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c7dc562c-d03b-505b-bd77-331756ce90b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:aacc5865-15d9-5fd9-a3bd-e7fcb140db6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:a0a71c45-c5e5-581b-aff2-234baf21bfa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:72456e53-2ad3-544e-81f4-03772ceb5157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:14652077-0e35-5dca-9afe-5659430e00f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:9585037f-9c32-5586-a092-510177da9652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:7076b366-eba4-5a0e-a1bd-51e9647bb490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:ea5ad4ef-7c78-59aa-b8af-6bec09183e5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:4325f7d8-1412-5b6d-a26b-df9d9f901acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:cb3df8b2-62ee-53e8-bf75-ffa807bdfdaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:36eac017-e874-591f-bdf5-a01b0d9c8a5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:e7137a1b-e7f5-5d55-8261-6a755fb3a66e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:6bef72aa-dd78-5b36-8e0b-af7519622d92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:578de59b-8f4e-5b0a-bb1b-74d00c4cefb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:52819e80-af5b-5979-832b-25ffcc9a7eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:e8f13d07-060c-539a-8f7a-80099f1618c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:3909f72e-fedb-5740-8c23-37773246876b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c0e2be1e-1469-5e3e-9cad-ecb90d37eee1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:fcdb48e5-07f3-5266-ae07-67f581e18248", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:719e9d6d-407f-5297-b374-54bc6b695a9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:265404de-74a0-503b-877b-51e9f40eac45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:4a441517-27fb-5fc5-b7c1-3c617c24c635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:f3307e8a-4f57-5586-af26-886bc6ea9974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c6eba957-436e-507b-84fe-91979cde7ebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:ffa05d02-9fbe-5315-ad56-8eb65471d5ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:cb3d21ae-60b4-5449-adee-99c21f43d35f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:6c70397e-34ac-5c0f-9780-b3adf9a33a71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:37a9d2e3-a93a-56aa-b6d0-2b15f74c38a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:88a19ae9-6ea4-5613-bc77-031553ce5aa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:da362427-20f9-5191-b91a-355b7a953c97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:59c94584-fa68-5c46-9c40-cdaac8fa1a39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:259df4f5-dd9b-5453-af69-b2ae748235ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:6cd68b8c-a030-5883-9615-26d9ca46a1f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:83aa4b11-e0d7-52d3-b5fb-a8c2a2b08d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:144b9be2-8163-5050-aff1-949cccc20a84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:5c8df350-d043-59cd-98f9-c928416c14e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:39f0edaa-d332-5296-ab9a-3d57d2cc15d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c6469abc-4194-5b39-ab99-cfe6ec0e2c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:bd4fa799-50d5-52fd-b1a1-ef769f662a8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:3138a5a2-6631-56f3-9e95-be4e30f0a565", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:5ee567a0-7278-5912-aaea-9013ff63ef25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:a5a3fa7e-b350-51bd-ad23-f9ecf5382c2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:8864e059-a58b-55fc-b4ad-4a5bee134809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:2689bacc-a9ff-5503-8a64-99f93ebe6999", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:cceaca9d-7bd9-5b4c-b5e6-8862073bf11a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:8be24183-73f8-58be-977f-c47e5303e9f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:8545d028-3e71-5a25-a502-de0be225c29f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:0bda8e80-bdfa-5eb9-b649-722732ac89c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:6031f4f4-45a4-5934-a964-805822e096b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c71c3852-24a0-5a05-8562-71545e17253c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:0fcf15d7-5f4f-5919-a354-43c043efff36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:b726d6ef-623a-5296-9ae4-d3019adf3c28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:53096963-5635-5c08-bdd7-4e2df51f8241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:91628d9f-c89f-510b-8212-43c08c088d17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.1" } ] }