{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c752f52-edd1-5a07-a8da-7ef973b90a97", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9", "version": "5.3.24-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d977318e-063c-57ad-8ec0-2ef1db4634fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.9 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a9e13b74-e7db-5959-a765-890f38e77908", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:274e94ea-96d9-5a0c-b212-15375f3fe487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d2153781-b8e1-5b3b-989d-ea289eb92e19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:536a4e80-7804-5d7b-953f-78b57801f2de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:178ef652-4151-510a-bb45-7ee116dbc501", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:59cc0235-fa70-5ccc-a916-02eab07f6f33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a82f2d5b-57cb-580f-a59d-0cd1dcb00afd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8f14233f-0e03-5f3a-ae22-df687a1f1334", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e276758a-6491-566b-8ceb-ebbd16dbeb92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:bef81f9d-6de7-55f5-a4f6-2f8c9e499730", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:1d722d44-fc8a-5ae8-984f-8f84dd90895b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7630beec-3104-5984-b040-93a730cb7000", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:372f72d3-3310-5f10-bad2-757eadad0047", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d9e656d9-6f2a-519e-b626-e62a0a50533b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:0322d81e-299b-5d9e-b98b-0c940651042c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:308ffc1b-3b6c-5e99-8781-68ebf040f9de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:127734fd-2c64-50ca-a5e9-8000523b3575", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:cfca5370-b36d-54fc-b5b9-17bb352bab46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:29722c4e-9f7d-5042-9c20-e2770178a887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b5bbf2b5-231d-58e0-be4c-039c0ad475e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2c9980ed-a550-5d50-b369-e96570b3c555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ba420e09-4513-50be-b0ba-8526d8faf423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:3f17bd28-5d53-5ce5-a2d4-eedc3a3645ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:36fdb28e-84cd-542d-9f3c-42c8b7df6685", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-web. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:836f84dd-a900-5548-a53d-6f4333652d93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d58d2eb6-d135-55dc-b097-2142a02e0496", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7a4bc624-ab2c-5e15-b4dc-5d0d84ed98a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:18bc27a4-8e1e-5d0b-82be-50d9c4cdd955", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e907d07c-4950-5668-bddf-1df8f9e9425a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:118a04b9-709f-5d12-bafb-84dc78fdd251", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c4f00849-b75c-5060-a96c-fb2877e142c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:85ec945f-1563-55c6-86d4-02f4f53cf41a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a78d9ac2-b660-5f78-a47e-f431b6ce9ba1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c6d298fb-3e46-5879-9fe9-3ae686172e85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:927cb229-4168-5e94-b258-c37aefc4bd24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f57c89f1-e462-52cc-8db4-20900fe381c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ae7ecaf2-9642-5efa-b42e-e566e3ca1456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f57c51f2-f6b8-5287-9342-27eb861e3cbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b8fc9970-1ae4-5e1d-957c-0f3004ad5d42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:1145474c-ac93-568e-8b24-99673ef04ec2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c0601690-c278-5845-82e9-dcc7e57a3420", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f14b3ed9-7305-5a19-8277-ac54b324b076", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:4dac4978-1fad-513c-89b7-c2cc0cb7a35c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e41b001c-4851-5e61-9e23-052d01cc3895", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:359216b7-5b9d-527b-9f0c-3731c93272c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:263fb2a8-021d-51ee-bb5c-36eb7add0226", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:55f1205d-3da7-5331-8450-8e98f0c7b1de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f3c4373a-14a0-5e16-a418-d3a436c25f6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:1670e554-9572-5517-9832-d8d01926b983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d21ddcee-e387-5b0c-946c-ff6f46bb34df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:cee4c8be-3108-5d6f-ba0b-dd641d78b025", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ff35cc33-1592-5144-b6ea-67a1f9863057", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.9" } ] }