{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f84e6ceb-6710-5bdc-bf21-d6bc7d8b03ce", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-framework-bom", "version": "5.3.27-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:af306409-e20b-5e04-9c30-e83c105d275f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0de2c060-6051-5eac-b023-34f3d1fbebc6", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:95e30135-6681-5cae-bb64-ed6383404b7c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3a520649-bf72-5183-9ddb-b18c78031673", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:79f76ed5-8803-54f9-b5dd-93d2c55c4062", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:44c9e00d-ceb1-5218-acfd-8536b8e379ff", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:57102ea1-a5f5-5418-8225-e8dff6eb5cea", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bce04c7a-dc0e-590a-b777-eb4f997bc4bc", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1e2e937c-1772-5312-8330-21f7c0ab978e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b7ec545b-f580-5ce6-8d31-dd7a9636e8d2", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1cd82958-1ebf-59de-957c-8e2938c57b59", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4c50d0c5-b60f-5fcc-a61a-04fc0960409d", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-framework-bom 5.3.27-tuxcare.8." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:44f7c6e2-da00-53fc-9b04-2cb765643fb7", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:785f2444-83db-568d-aaeb-4eb2a8837671", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ef590d85-3feb-5ab0-91b6-016d985500b3", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:55be2765-09d1-5ccb-ae5d-241a87a93c1d", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c8f57732-57bb-5b7c-becd-31194f38159d", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2eaa7bbb-21e6-573e-aea4-228cb79f2a7e", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:52f28b84-3bb0-5bd9-b75f-755f29248d93", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c71b01b8-b76e-5391-912b-10856dc10144", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:60ff609b-37d5-523c-b7a8-601102bff90b", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0c0be9c3-bea0-5d17-9db8-eb0c521c1a3e", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8b4aace9-f412-5388-8371-c9e2edf3c5eb", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4592c5a5-2cbf-574e-8704-24b0c3358234", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7e7a30e1-b963-5c12-8fea-b51d14b1dd90", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:113728c5-981b-5b6b-996d-290b25b75092", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9f15e2bf-a2bb-5875-b9f3-a9567ce2e7ca", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:41ba6705-8586-51f2-b9a3-6104573695fd", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a1b22460-83ff-59aa-a431-8fba09eabd4f", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:51aee10c-2509-5c47-bee5-7703a3f02cca", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4695b03c-fab6-58b1-9afe-49ba9c75202f", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d11da5f0-452b-5c54-888b-b288e67bbd4b", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4eae77ae-ce80-5d77-83c2-656a3348fb0e", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6d4befb1-c447-5154-bee3-30219deb4835", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4ebabc33-3265-5f10-bb99-fd78748d7f09", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:05d6b5e7-8fb7-5f62-a9f0-42a77c923959", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:58cb730a-c171-5eb8-b3a9-0064db7bd27f", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d13a5ee1-e623-5f9e-a61b-357b45855cc2", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:32ac21bc-926c-504d-b127-1d047dd51927", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0fcfd149-f019-5ce7-be4a-ef52631ad10f", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7d0da981-9f1f-5087-ba7c-1904b4425b10", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fd938582-4dee-568c-b9f8-63427a349aef", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7a61e74b-8c91-5aa7-b4c3-6a27f6c1c99a", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b6fe4011-1890-570e-b8fc-f2d1829e5e09", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d1ab9dd0-2aa1-51e3-85a7-b450495f9254", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:262dd297-8b76-5105-91a1-7f404a3fed16", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ff564f67-ddeb-5303-b1bd-0d70ab40a244", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c50fd585-44f2-58ad-ac26-065a657fe54b", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:08f09fb5-3b00-5d1b-adc5-f724671ccc9e", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d2df8824-cd2c-5eef-9164-40fb9a5e3a3b", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6ca2bb5a-6448-575f-ae7a-8fd075720edb", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8" } ] }