{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dd7060a0-fc24-5e54-b4b1-cc6de1026531", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10", "version": "5.3.25-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f78c7432-d461-5253-bb7b-6c99f50f0c74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.25-tuxcare.10 of org.springframework:spring-orm and will not be fixed. CVE-2016-1000027 is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:656f1372-4cdb-509c-ae63-d86869d6a07a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:034ac3f2-32ee-58e5-88c3-4671c5bb8a74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f00c4b91-dd84-57a2-94a1-8a3f7ec02092", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:a584cda8-a9d3-51b1-ac53-c9119a99a569", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:a8f63919-3887-5ba6-8c5d-bcf32f90cbe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:36340137-5232-5ddc-b8a0-be14c6c7449f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:9f4bc538-5f59-5bc1-99e6-b3e74c64171b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f18e49f2-b41b-5e05-9f8b-8485c6dc1425", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:4196a773-3444-5728-8a3a-e024fa266ca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:ad2acaf8-06f0-557a-b7bf-1c867133520b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:ba16d039-12c0-563b-b4b2-6fc95db129a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c60288e5-96df-59b5-bb47-3cf2dae98990", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8b47e931-e581-5506-8841-94d929651695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1f2a836d-62e4-5743-bc14-282a8f1c23a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:be076af7-842a-5344-8fe5-2bdbd010aaf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:30be9098-248b-50f4-b8c8-590de242ad50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8c9dc3ed-5542-57d6-b1d8-7d58804a028b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0d1d0b42-9c10-5afc-8e1d-1c941196ce68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:e829cb18-10a9-5e1d-9564-8bc6e479b190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:6d4c5985-f3ce-5978-8133-c4b95b2cb0b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:7018bf0e-e189-5167-a55f-d1e97d94a04c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0dcb45b2-dc35-5d70-aa79-ea488d9e87a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:6da02195-91ec-5f7c-85f9-ad11a535c845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:945c43e6-ce8a-532d-953f-b9e806679b21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:3c2d86ef-bea6-57c0-9aa7-01b459663e10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:bab02fcc-d7b7-55ff-a25b-1ae1afb0947d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:443f73eb-d3db-5c6f-8393-6d62b3f39f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:b061c937-6998-54bd-b968-31ca49d294b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c299900a-1ac3-5715-b94a-a74b50518527", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:73f50833-5798-5985-8f07-8d793d273a7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:43f49372-129b-5e6f-bca3-e498c80ba995", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.25-tuxcare.10 of org.springframework:spring-orm. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:d3bacec0-637f-5999-8c28-7cdc8ed3ca9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f06bf8e4-bad7-5d6c-b80f-4e41d9ece1c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:7290e50f-5b4b-5821-b5c2-2b6ed28726f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:576e8fba-ff60-5b23-9e01-8a84b4e454d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:4d96e0e8-24ce-5924-8a11-660a704da068", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f424b2d2-e35d-5295-97f6-6200dbca85ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:a6d153df-629e-56fb-9a9e-f5f250108c53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8fa08aba-e3a0-52e8-8df1-dd2baebef9a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:9b764db3-1bdb-5753-abe1-8dc168ea3f53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f04953db-afd2-591d-b77f-acfebee2ffb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:202b8658-1cf7-5146-96e8-5526ac845d99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:7f387e4a-3993-5b13-bdf5-9c5becae67df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c979ec61-17ce-507b-bb09-5eb78c856458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:64efa54d-f8bd-59f9-a013-f7bf51ebf924", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0ffa47b5-a066-54e0-abe6-86d956017d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0535b150-390b-581d-9486-24eb29f2acd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:75b491b2-b7c1-58a1-97e6-39da51c3e8a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:55407586-a319-58d5-bcee-169fa219a9f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:09123459-c964-574e-b731-3af4fdf7f200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:7ab4e35b-33c6-5815-b9de-9da0ae70ccb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c33d4ca5-d8be-58fb-a44a-0aba41cf31a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.25-tuxcare.10" } ] }