{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e1bd05c9-019f-5bef-b0b0-d06d29b7468e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a86ba0d3-b747-50ad-9f9b-9237bf36bf72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2ea736b6-37d3-5796-b7e0-6480ec72753c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7fc3eb2d-4a6b-5b0b-97aa-5990d6cca1bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:224ebc58-6c78-56db-b3ff-1fd1678f3213", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a274a46a-5e6a-5733-89bb-2f0d27f18825", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2392ae58-8b96-50a8-8067-c2c496fb1098", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:75586219-f7a9-5eab-b035-86ddf5236110", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cade16dd-1f28-5127-9f96-435da385f7f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1641898b-293c-5575-88e5-2a06a717c0dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:489a7c75-3726-52e1-94b2-34e3f9622646", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a1ce0b8c-5a0a-50ba-afa4-b7d3b77c56b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d5e7de0a-8a0b-5929-a5a8-fd983b5b781b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:690c35ce-aedf-5843-8544-279a325c090c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ea470d9b-c2ac-5dd4-b2b9-9b777a58c9fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4337b1fc-3d75-5fea-9a66-25b613bb31ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7ba6b01b-f898-55b0-bf37-98ea40cfc859", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ea7e6796-c51a-59d1-8e31-b925f7cb8b5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c90ceeb6-91aa-51de-81b4-1f42f26c097b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:985d4b13-d87b-57cc-b35f-224ab40e12b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:55849947-db80-5ec9-b86e-23dc4e70e294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:257082cd-59b7-5d8b-848f-aeea2fcd2f37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:630bcfa5-f3c0-5a68-a99e-d3154fefdc6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f96fbdcf-ace3-5177-9b73-10f5549c09f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae5873be-97ce-5ae7-ac41-46bb6f066479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6167f5c0-040f-5631-b790-c5baeb3e3538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4fd0cf78-c478-59b2-b60f-ce5ecd5f8109", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:74efd2ad-5f26-5913-bd17-3272c114114c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bcbf3bd6-38c9-5fbc-86ae-117a2321f0e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cf157e22-4acc-5687-8d56-c8eea21cb0b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:722b8fdb-885e-5fdb-bcda-4911db989cc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:65930365-6b92-5a69-b827-08e17793326d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:81820286-bba6-568d-ac20-0d014d261d50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0b924d77-0aca-5f03-834d-2fb6863d52ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5e954fd7-bb59-5dfd-b875-e237329122bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7a8f5e18-b235-50a9-b285-691462bcd2e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f1a2700e-29e6-53b8-84bf-3a75506dfb20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fe610a39-9ba4-50b5-82d3-bb7b2cffbcb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:731bcd80-a2b5-55ec-8ac0-00832cba5a97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:788e8700-6610-5508-94da-649f33eb5cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2097db82-0ccc-5864-b03c-6ee8e18f20c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:29cd451c-3e7d-5709-b3c1-81400bb816c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f2d3229c-7793-5de7-a5bd-659b78048ceb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cfd22073-72f6-5518-8c66-b00c578b917c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e839afe3-b613-573c-bcbe-19f5e28bc32c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:79ab1660-0e3c-52c7-b7bd-0e006e66f007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6b302e44-51aa-5f25-8387-30d542399dc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cef7d531-d934-51b8-98aa-d71a52d775d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:92271cd2-2c8b-52f3-8269-94b772d57408", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c068c6ec-e7db-564b-a7d8-c51dfdd50aaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b6cf6229-55a5-581f-b5fd-d60b5b19250a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0754abd4-f00d-506f-aa49-792fb063ec54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.11" } ] }