{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ab411e93-0573-50c6-baa1-13ef2f88dc12", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "5.3.31-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:40a685c2-3b50-55fa-9336-159ee42acddd", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2653f79e-91e5-56dc-84c6-5fa28968e336", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d85b6542-ece6-5b18-8591-607696093921", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:91835ce1-9d8f-5d71-810f-cf5581e08377", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a36f1ef0-23e4-556a-be2a-f019c5f68bdc", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d58857b3-4c1b-5f2d-9f95-2a55cd985d73", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3f6245be-643d-5cf4-9005-1ef0c1d42d3e", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8b0325ee-ef64-54fa-b2fc-5653977a9fc4", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4a9b11b4-2f9d-51b3-898d-7dcc20100cd2", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4caac233-1d9b-5d72-9bab-a5a0a3cbcf0d", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:cd673947-6bc5-57cc-a0b2-e94f992f1e7a", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:838a9d6a-4dac-51eb-bc16-57adccefeac5", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-web 5.3.31-tuxcare.11." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:73dfd7a6-d075-5b2d-9cbd-ac085f5017ea", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:952931f2-90e8-567c-b851-bdd74e2c0a78", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:59d97458-c73a-5cf3-bb36-50259533d8b0", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3fee4d7e-9d85-5b18-9fd0-5e03b646cc71", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:37f4350c-5384-5004-a695-bda77f85f0f3", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:acbbb5b2-6511-5e3b-ab44-1671da98b048", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f5bd0f96-4add-5010-920b-b3815830cc2f", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d182e164-921b-559b-a837-940b6fe6dd9c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:91432cb2-a9a4-5e1c-a788-3c67ef447b74", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9086be6e-03a8-5342-aef3-002644d4a406", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:27b047a9-fbd6-5372-9521-e8452d05a0de", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.11 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0e968f00-160a-5cf5-abf0-cfc98b526232", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a62f192e-a773-57b0-aa5c-93763e8661fb", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:dfa435f6-66b3-55b0-bd08-e198901ad792", "id": "CVE-2026-41843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:99c091bf-a75e-58e5-b2a0-284d6fec1bdf", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:61e6b62c-1364-5b88-acb9-b4308802cbc6", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:790a2aec-55e3-5974-b2a4-a828a97aaf8c", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:74a3109c-b67e-56e3-92f8-08793da356a9", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:24f78dc6-ed5c-5dc4-8e40-5436b47591b8", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b8078b67-4e28-5255-ad0d-337600c79365", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6f47c34e-9643-5d8c-a6bf-d55fa5aacc39", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f3d07650-f4be-58f6-8a38-5d2350f3b5b1", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:bfbc7b26-2df6-548e-b830-338756e62006", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d2034da0-5644-5300-98d0-c9b7763c04f6", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:379e3913-e07f-50a0-962a-89fb3fda8514", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f672f6cd-0a8f-59be-a8e7-b9b718e0227c", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:26a0a1c2-ea9d-589a-b8b5-9efad0789edb", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:398fb158-3345-53ae-953e-f505c5323c4f", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e8d4a8fe-523f-5f42-8fe5-8f4415279a14", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d4102659-e37d-5160-9b64-dd268d46624c", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fa75c6ab-fca3-53bc-8143-4ba5cf15e351", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4c15dea1-2b23-5b18-b3ab-aa6c936191e0", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8149454f-e6c1-5103-a71e-662022c91720", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9aa1dd1b-5401-5b97-83cf-28f439f8c9d7", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:37a3e639-c26f-595b-bbf0-79af86e113bf", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b616e839-10ce-503e-9083-4e7091d7e006", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:756b3300-634b-58a8-b145-2e422cf0a733", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c70fa517-b416-5a10-9fce-3315aaf988fe", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:af2cdadf-6b50-5c22-80bb-f3fb2a7d1a13", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.11" } ] }