{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7f3196c2-4371-55bf-8806-2b4f5c97cb0b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "5.3.30-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a337ee5a-5825-549f-80c6-b6f95862fbf9", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0105ac72-50c6-5320-a006-89f390fbba66", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:abdc51d5-ec72-5274-9754-f53f9c14a47b", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:26313b49-b41c-568a-8e5c-bcfa271f48e8", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d32b354c-de46-58e0-b1a9-6b143f12a704", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c6934485-279e-5156-bae0-541b60b743ff", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:cde9c0e6-dd46-5527-9bd7-67ed08a4a66b", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7f0c1003-a377-57b5-89c9-d9023429127b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:969a6370-5eb5-5916-bc4b-5e1562a3deaf", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f4063971-4226-547b-8922-75cbabb1d185", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:806f67d6-fcce-5148-92a4-7225d7303b88", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0e5b1ab9-ecad-553f-83ee-c1a853689b8f", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:41b7e5af-0218-5323-8ef6-69f75e0c81e2", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:384c1187-f2ad-5b2e-91ba-4783b7e61714", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:df3e5a86-3e22-5d25-8927-43534a144138", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:db1024a6-87a9-53c9-8fa2-9715923a8688", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4fb6a7a3-2a5f-5ec1-b558-6022c2a915bb", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a968f043-8669-595d-bd94-bada9dda26bc", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ae457561-afb3-5264-aaa8-4c25d0b90cfa", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2f81d752-562f-505e-a8e4-eb2916afc6a2", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f3c36ca2-15cf-586f-a687-bf7ee6369cf0", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5fdfb2fc-02e9-5ee2-af1d-7a84682dcd82", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.8 of org.springframework:spring-web. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e3e689f0-964b-532d-8252-135512d6b494", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2f60f1c2-1128-5478-a063-1a90f08eae0b", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:86f1c7f1-47c1-530e-b547-c1df5a983d1d", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8e622946-6509-5ec2-b374-983bbd7a8d85", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:99531b88-f2ea-5309-baff-a99ddfcbb145", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a508154f-4246-5cb9-8f6f-4f57283a1b0c", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:46b9e910-2a82-5868-b1b3-7e97c650451e", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7f776f69-37cf-5c72-8f3f-e400c2cc3add", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:004af7ac-542c-55be-be7c-da7fee2631d9", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3f5a2354-0296-5760-b8dd-b69669df10c0", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:418be176-f8ca-5372-9930-ade0ad5028c2", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fec95b6d-9255-5aca-8125-b1b413e78914", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aeaa7b66-92c2-555a-93e0-666ae10c6a42", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5deb2ba6-f407-5ae6-8f9f-bdc996572542", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ecd33f6c-98ff-5e27-97f2-88dbedba5352", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3ba4157b-3a4f-58b9-aec2-7c9de9937ecc", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9e12cc4a-7dc9-5063-96a2-cc3467b53bb1", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:dd0c0588-2259-5b4f-8eaa-676dd288f2c0", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a149e382-1819-5b13-8568-56c42609c671", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:933d6deb-ca8e-57f8-8734-4be95b3ede36", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:948de5af-20dd-5054-b105-e48920eb65b4", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:90b9cb20-9cf9-5851-9bc0-b1b8488ca8f1", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6a086c59-0516-587c-8da2-062bfc2cae9b", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d1fef258-126d-5743-8573-698027230e6e", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d97660f2-8424-5c2a-ac5f-81475d33c50a", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fc427964-bcc4-5417-8d07-77a11f6ddcab", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:105853e1-f884-545e-b24e-1d8335382dbd", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:abe08ba9-0722-5702-b07c-8c85462f4e15", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.30-tuxcare.8 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.8" } ] }