{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:897f9708-1b4b-573b-9e47-ee260512e355", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1", "version": "4.3.27.RELEASE-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:480a5401-22aa-580f-bc59-6d6bdd2dcdd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a5b9cb60-dd37-562a-9a44-635eea66284e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f05c5578-3822-5ee4-b7bd-776f703b0882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c12a3655-c07c-5f2e-ad01-e129eae88f69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm. Spring Framework 4.3.27.RELEASE is not affected by CVE-2021-22118. The vulnerability exists in WebFlux's reactive multipart handlers (SynchronossPartHttpMessageReader, DefaultPartHttpMessageReader) that use fixed predictable temp directories. Version 4.3.27 predates WebFlux (introduced in Spring 5.0) and uses servlet-based multipart handling via Apache Commons FileUpload with servlet-container-managed directories and random temp file names, eliminating the attack vector.", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:72f19bc7-22c6-55b3-b200-30ecaa9e7738", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aea413d6-d54e-5824-a472-b4de506e8be1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:93fe3a00-ef37-5df8-8a9a-94ddd8f81ea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:20079d90-9702-5fba-b747-9bc02fb7db6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b13b136b-27c9-52be-9788-32f7ba8df86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a3c47042-82db-5fe5-a988-ee4cc5fcc9bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2ffa3b17-030e-5c67-aae8-1675c36a97bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3a700988-9ec5-54ea-bb3d-43122138e322", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4303ab3d-2b25-54e8-a876-3506fe5d04dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:591a2f08-6f79-5fd3-91eb-37d14ab19cd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96c89f78-85a7-5047-8c53-f6f8aaf2461c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:599a3a16-2abd-5a10-8659-470ad796233d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6872b9dd-6089-5ec9-a1e2-9cc1ca0b8b22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:19e23b15-499e-54db-95b1-5561edc4a659", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2024-38820 describes a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields pattern matching, introduced by the fix for CVE-2022-22968. Spring Framework 4.3.27.RELEASE is NOT affected because CVE-2022-22968 was never applied to this version. The DataBinder code uses case-SENSITIVE matching without any toLowerCase() calls, so the vulnerable pattern described in the C...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:97405204-c4b5-54df-a7b9-5eaa598c358d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c6ce6670-fb81-532f-af7d-96462409133b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:481b17d5-fe19-5c58-83ae-472d0904394d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:695b63cd-7fa2-5e2f-bd55-a5954bfcee12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0a66e704-1552-575e-8920-b74b41216482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f934b6b0-faac-54db-8c32-d28eeae0ea81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:464addae-05ae-5932-a356-dbfc90ef5c21", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling components (PartGenerator, MultipartHttpMessageReader) that were introduced in Spring Framework 5.0. Version 4.3.27.RELEASE predates WebFlux entirely and uses traditional servlet-based multipart handling with a different cleanup mechanism (finally block in Disp...", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:30ab6049-51a4-58a4-86d0-ed072abbe30d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:db351bf3-35d3-5c96-8083-fd0073b24acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5f18028c-72de-5505-adb8-bab4cada171e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:16b16521-78ff-55b9-9249-15b83377967d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bd0efb21-5865-5440-a020-271824144e4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6b535704-a44e-5aa8-91df-02c442b3d351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cdb36cae-64bf-52e0-b8bc-7dca47da1b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d753c895-1c42-51be-828d-83564df9f769", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0559f6e0-fd6b-524d-9c34-22b6a853c088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e70b099b-635c-5941-aaa0-efc5c705b4e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f9ffd87f-65ee-5973-b423-ec3916d3e372", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8134d492-d736-5da1-844d-986a30c1d1ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1896239-c482-563c-bbdc-d6a28adbaaf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7040641c-6fa3-5941-bcf7-f004e21a3a75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dca38911-40bb-5930-9b00-84ea3105f312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3ea1061e-9eec-55e3-991a-ad948c4000c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e4c87a1f-df60-5846-841e-6297d079b938", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d92f3d3c-40cf-54b0-830b-5085ee4f5a52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:97f8e06e-7180-5b17-9d0b-24ac83a74da7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0fc6bc27-c132-5f35-a389-3b5435320e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b344e4b0-2892-5548-a79e-71eb9fbda060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6987b01f-0ece-59e6-9a96-7c064082f1bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ffc08756-0475-5f85-9851-c607b1d02876", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d34688d-eac3-5beb-9f79-36da08cbbca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c42a76ff-bd17-57a9-9ced-e4b9a6a182e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.3.27.RELEASE-tuxcare.1" } ] }