{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:09f393ba-d7ee-57ad-9057-77d82f5e4477", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15", "version": "5.3.31-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b24fdfb4-c9df-50fb-942f-5449090e7f5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.15 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:01b91034-a466-5e05-b487-e60d3d689687", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f8a516e0-517a-5c17-ac24-7aee474aeb16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:bd6a0bbd-78fe-5bf7-b29a-05882cb94963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:68e8f0a6-a0c2-5f8d-9136-655b8f6eb427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:107ed383-3b7d-592e-ab17-8874efcf3d7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f77520b3-8d6e-5626-baac-4e65a3e3c369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:edc9ab0e-27c0-5f83-a8f2-2565f0fec1d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:bd11be80-1b9d-5321-beb4-463df0aa137d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d887a855-7f50-5d36-b492-92e4d5fe75ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c7105cab-fd4a-5992-921a-eef244c02071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:db5a0080-7a2d-5bd6-b3f1-af0c2c679582", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-orm 5.3.31-tuxcare.15." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ec850ece-34d1-5db9-80fd-7fec45149476", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:01fdcabf-9b78-5d6d-a7e0-580f8bce52cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:34265794-04aa-58f5-9acd-4ff630bac3a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c849e90e-2ddf-5ef7-acda-7ac05a1b714a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:0defaa51-250f-5bb9-93f9-790084516eba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5a3e9cf2-c48c-5f74-adc8-a16b0fad0e32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:55dd1c05-b16e-5d4e-ae62-e5c5bfa4c239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:55526168-bf62-5502-8161-8464a3fb4de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:7f622e24-b113-57bd-9d62-ad693f8068c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9e0b9c5a-5107-5ce6-9f6c-a4cfc7edcc67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:68ab2ced-fdb6-5da7-861e-e88eeefa7f5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-orm. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b55ced8d-7314-5442-9d2a-7a7f0d66ed0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:e9c7faae-e6fa-594b-a0e1-fda3fd84519b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5e7d1df5-46d5-54e1-8912-a6f00d5ff6ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a1e75e92-18db-571a-9231-5b7637234d3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:352fdb47-5427-57cd-8805-8429fceed53b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:3c12dbfa-7328-5942-aabc-84c084dbfe9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:212bb9b9-33fc-5053-9a6a-baa36906682d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5cebf116-905b-5a04-96e5-12ace8417559", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:34b12454-7523-552e-959b-f3724f57665d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9f2b1ebc-8333-5387-96d1-753ed60c2979", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:896d49d5-dee5-5f68-ab89-5bbb4299b81b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1cd92514-4223-5e4e-ab97-3ffeb4189d3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:fb1a3704-3be4-5a64-8c79-1edbec27880e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:60f9ee82-f1e5-5488-aeec-2115c6d48131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5bf49937-5885-5d8c-a75b-78c20c5d49d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:42660b30-9ccb-5eb3-a99d-40a3638ac7a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:7d3422c0-9232-5f4d-801d-c5b57981f305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:aab6fe8b-19e4-5d79-a4d4-85000a8c7579", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b302b30b-3697-5cf4-9225-4e8655c9e4a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1af5f8a8-6c95-57f8-837c-5f84fe700b7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b96ce41b-966c-5ff6-81f7-d3a5a677f6ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8da94cca-3ce1-5d32-9971-122e434cb89c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c20f7a64-d0fb-50de-829f-81d126c42dca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:152133c2-2471-503c-b378-13144263d537", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:7c837b55-99aa-59af-a4c7-00afad6aff3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:67ce8174-e149-5e22-bc14-dfb5225ea494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:fa3b26ed-3fe2-5c5f-afe1-8be340d3d25f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:73211b2a-5148-511d-afc5-d2ee0de5c6fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.15" } ] }