{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39b99e83-cac6-56e5-bf42-649d4edce4dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2", "version": "5.3.19-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d5369b8d-6a17-5458-b33b-d8e5fbcde9e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:adaa48eb-d3c8-5c43-88ea-836b2b820937", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9d759790-c066-519f-89e7-abbf4b2aee12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:1d51c163-8ca3-56bd-b85d-552bbcf86122", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:b6c38afe-4564-58a1-83b7-4df6dc92f363", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:03b47654-4949-509d-94e0-e7a232b02d4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:7f16a152-5be1-5bc7-b491-fe948fca0c86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:ecca7ed9-83bb-56ac-9449-f19cbe5fff3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:92ee9ca6-1873-5ef8-9434-bb80725ab6e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:83e965f8-dd02-5db7-8a56-f07149f825ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5d6c3eaf-bd09-52f3-b6ac-ae04344f5db7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:a4a93c98-90e1-5318-91d2-1da49d178a00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:f5d5cb87-a6cc-5ab2-b43e-ebe878784c79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:25bfb0d8-d456-528c-88ff-ee4e1bd26045", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d1ee8923-9134-5738-a9d8-1f21aaa6f6b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d6eca5be-cc93-5947-91c3-5d9626766bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:06de1175-7ee5-5138-be8e-db32473a1964", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d5765ef0-fd6a-5c8e-b8ea-bcd6c91bf332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:ed52ac61-90b4-5b8e-9c73-8677c1701fdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:44a51638-fefd-5403-b83e-37ad6b60af93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:1f876a1d-77c9-5f07-96f8-3178414a322f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d5175da9-a249-5ec9-8d2b-9c3aabe6cfbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bf40480c-b303-548f-9001-1e55ad773f42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:aaf67450-0833-56a9-84c9-d7640bbbfe59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:2c2f2aa9-d9fb-518e-8329-6df28c696bf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5c9a9880-67b8-5a65-8dc6-a594c9fce315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:f2e68435-4b96-5e81-b240-f099335ef17b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:454adfb8-ce1c-5cf8-80c5-d22bb3d9e197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:648c860e-e31f-5524-a50a-ea9a57807877", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:dd7648e2-5a17-5c37-8862-c54c8447fb50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:18b854c0-3408-5d62-8a05-22739bfa1a51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:06dae351-36f4-506e-beca-81704d5a72d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:0fc83bf6-9c3a-5540-ad37-df6c43826ad5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c6763a45-a810-5391-a191-09e87877fa8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d6636853-16c7-5fd4-b5c4-a1d688500a58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:be2d9bc0-3818-594f-aaf6-049ae9c6455e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:be1d9778-5f35-5c51-8c3f-fe87b978107a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:0f53606b-bf4e-56e2-85df-56fcf213b85d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:1e25a167-81d2-5eb6-86da-b6f2be593301", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:79897c03-d0a5-5c5c-b72c-92a41eadedd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:42f5d6cc-0931-57a2-bd63-a28970e89a71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:56eab5bc-3efe-5070-8a38-068d9710aa4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3843ea99-c1dd-5a6b-86c4-8c0c51078696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:10f53235-9774-56b3-a636-eeedd224808f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:fc34a9d7-3299-568e-8232-9bb810f1cf50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9fb9a6b0-c220-5949-83e5-dee5d256ec5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:14080750-8bf8-54dc-b9dc-a5ed978bc82c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-web. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5d505525-4729-5dfa-ac1b-1fa0cd2e8fa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:fb685ec1-8ff0-5f62-a348-4391e830c078", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:cf716baa-c12d-5c63-b72e-c2588c64065d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:73d19ca6-7d9e-5399-962c-6e2755f47168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:0a59057c-9cab-5bed-add3-56c0a62a8a39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:cde827ab-efa1-5a09-b64d-2f06b1ccd7de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:ba10a1ba-a4ed-58a0-b2af-0796940b91b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d49f2a53-7b03-5c47-804d-54e6eb115efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d4a85e21-9cf8-5414-a726-6736c085261c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.19-tuxcare.2" } ] }