{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d5f51ce-0551-5984-8ef6-86e20fdcc8fe", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10", "version": "5.3.25-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:caaaee73-6854-51b3-8694-cc9d7d7d7bd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.25-tuxcare.10 of org.springframework:spring-web and will not be fixed. CVE-2016-1000027 is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:3253e627-ec1f-526c-ac98-1603a1faab06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1be1d829-0d95-5ad3-97ab-a299212e45a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:2d37c9fe-3cb5-51bf-9767-b4fe4a02cd25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:9d77ebcd-70bd-59a8-808d-87ca73e758df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:d7b46269-5502-51f0-ace2-c7ce9c30752f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:2fcbf5c5-0aac-5640-9796-ed9a42a40bd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f07b9b47-9faf-5e67-ab75-d23ee7c5e699", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:79e71337-04e2-5aac-bc24-9db54544e871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:fdb21341-40eb-587d-a274-f3061df7be47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:45ac43d6-dbb9-59ef-9044-42b75e623ab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f86fa1e6-ffdb-56ce-a9de-13992d952a45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:df174a75-aff1-5f1c-8fb2-b4e97415c54d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:d2b69f08-3344-5867-865c-3bfcba8e400f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:14c66bfc-0732-5670-92a3-85e84976291e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:2a6bd70a-8f6e-5a3c-9adc-170cd592552c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:dd21fd10-968a-50d7-ad17-7da65fe0f2d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0617102f-1d92-5ac1-8755-c5df12840846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:abbb14e4-4044-5f85-be66-383d51f142a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0b6e00ac-2ec5-573d-804b-fad6c4b1cf99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:949c8c7a-2fb7-5f89-84f9-1421d124f7ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c41a626f-ea47-505a-8d4a-86610d1da13f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:15978149-1d6c-56f5-8dd1-7e4c8928a22e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:6a1e7b12-3909-5daa-bbde-faf680315ff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:55455bf4-a152-5d14-94d1-4ea50c3fbf26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:62fbc419-93db-550d-ba39-1e796eb65a8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:3b92a87a-ad9a-521b-be64-f833e422e909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:e51c397b-770a-5e34-86a7-ef9b37fbbe60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:209d6aeb-b358-5843-835e-2390588dfb10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1beecc30-986e-59de-a33c-0019c6398c0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:b599a58c-e3d5-556b-bebe-bc781b41f642", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:4db86459-c102-5907-b5be-d9c87637ce67", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.25-tuxcare.10 of org.springframework:spring-web. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:b25a3921-5d12-5b7f-85e1-39a8f77aa81a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0fc262c0-b192-59ff-9e32-625121ec9a50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:40925551-fa52-5561-8fbe-e790423f4e81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:96931cdd-e22a-52b6-acc8-dae75cb1045a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:82e116d8-34e6-5855-80c2-f6dbf95da544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:79215b6c-6bee-5454-aee6-32aa6fce25fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:49ad5fc8-8af0-51e2-ae8a-66820bd94138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:66201a1c-03cc-58db-a53c-2513e4618c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8ebc08b8-f685-5ccc-9d47-4a97de55c4bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:052c5bf6-1b22-530d-ac95-b0b020508d5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1cd5b49c-e7a1-540d-a488-1e9b5c411ae1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:3d62a633-84e5-5b5a-9af1-5507e5994280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:e1f7e7da-1490-5e0d-b4c7-bc1d3a86ecfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:103096cd-658e-5cec-b824-f85dd180b220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:45b87a31-b33b-596b-82b7-2a2794029354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:66b7aa1e-4bff-59b5-a297-a435bcd33b8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c59a0a6f-5a98-564a-a57d-a4f155c49ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:6a551211-2d4b-5631-8924-76af600bc3e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:ddd9d025-9625-52d0-9096-18d7275f0b88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:7342975c-9de5-5892-967e-aab634cd3f5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c3a9cd38-ff4d-5274-9eba-7bb9d2c55efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.25-tuxcare.10" } ] }