{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3844e26a-2c0d-5778-acf2-1ac5f34b5315", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2", "version": "5.3.19-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bc4c52e7-29fd-56c3-aafd-b0b6d56c9400", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:7e276a5e-c0f4-5c96-9440-3db11d640f96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e3482f56-b691-5ea5-9873-a4d10a130ad7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:08646bd5-7ab5-5bbd-96ba-2be2d17547b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:347ab3a5-6e35-5587-bfda-0af7bfd93581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3270fcc9-16c6-5ee0-aa47-37b9975154cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:7ab6fbf2-b821-516b-a4d6-fd94843450e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e5c2d1f9-7b75-5151-8b5d-c543338b9630", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:af22c4da-ace9-5de7-8639-291e5696768c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:faa6912b-ce95-5e23-b847-a98f930a2d6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:504a338b-0b06-5e2c-8b6a-e6bc176b0160", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:06b1ab48-61a6-5296-af4d-b5c1b8db5ee8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:fd0e9629-1c37-5155-a4f7-b60df94a8ab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3066d70e-c93c-5448-aff2-f1ca6b3388a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:0ec0ebe2-a16c-5260-bb7e-af00ca37372f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:24d47f62-0d2c-52b7-93d1-828c6c803a7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:04746c57-6458-5809-aeaa-eeb5cc1b74f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:aec02a23-ba88-5d06-b783-a5ed937afc6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:337d2be1-f515-55f9-995f-c12f31c74f84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:48f1fe6f-72c7-5d28-b907-b8bcbaf1ee72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:2c3d51b6-186e-551e-90a5-2e3d4eb8f64c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e3d9a74d-e706-5394-9ff9-638bbe7b9a06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:27cefc09-7a7a-5b2d-84e7-e7375b66527f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bc7a6649-3d91-55e8-95a0-558aa93021f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:24e15162-3f81-5c2a-accb-e4d8453cf0c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:00d71a11-86d5-5498-aca0-8c59c268acf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c0f3dc80-157e-5b8e-b231-f6c08e78490a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e5db06cb-0ca9-510b-a997-fdd0cb5e6e56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bbdd669d-1ebf-5b1e-b743-0995646fcead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:ef18f528-ecc7-5232-b8e7-644c6a4487a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:2bee3e5b-27f6-5cfc-9144-8e5a4c23e9bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:af6a6f7f-9580-54ec-82aa-f7f9c8ea2d76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:27e72b16-bc08-5353-9aa4-cdb62b46e1ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:18049a80-e8e8-598d-98ec-81d25041d103", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:6d2d5e66-6740-5aec-b3ce-330be0407e95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:0bc1c187-853c-599d-8ba7-c9d6c65e3243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:47d8d477-3dcc-567a-9aa0-ea85097f55b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bac18da2-ac0c-5710-9319-e26e2a692c66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:2f8600cc-9cee-5190-80ad-f81193b9bc38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:007ece64-409b-5986-a1f2-5356067560d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e67601ef-a008-5591-acf9-5b54f5518689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:670f447d-806f-5ccd-b603-b6128e514772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:f304d114-bd96-5c6a-90d0-06f138adceaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:46c6c17c-dfa0-5237-b634-5f5f710a2956", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:12fd634e-86fc-5954-877a-46ae02f127df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bfb2a944-04d8-5445-8a98-3d1aa3af6fff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c7ced981-4337-50f1-ae98-489331c190de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-orm. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c8bd7e23-9a7f-5c91-9c63-82017af04eb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:2c5bc5dd-4749-5f13-a28f-94dc947846c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:570dcc0e-16c3-5d75-8944-1932800e2c05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:02d7ea01-da03-5d45-9992-691cd490c2cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:a49fe05d-f08c-51d8-a686-412b50af2e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:b9b09b9e-5470-55b8-aaf4-da5d71373bc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d2bb0ae3-2bdf-5224-9c82-fb56cb786e98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:21da2828-4571-5fa5-b15c-49aa97037660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bf8d9330-ef6d-525a-a540-31d64c4faa88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.19-tuxcare.2" } ] }