{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6d222ab6-9027-5981-a612-a0244ba8768c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "5.3.30-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:262a9f89-0d85-5064-8da9-fb7973c6e079", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c8673d72-1443-5eb7-9674-76c43e18b09e", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b8e2c800-d713-5870-9e6a-8172addd8fb1", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5d4a126b-50ed-59ce-bc80-341fdf5b4229", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3c9eb928-3c41-51a2-9f21-5872a37f275c", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d15bd5e1-31df-509b-90d8-884a6a0c22ce", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e364ddb5-49d4-58d8-8f24-2fde12ee8d2f", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0deea81c-e0a4-5d62-8c07-df0c3a7446c0", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9f9b7539-0e4e-50b2-a60d-2ab9c2e61d58", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9862f3ba-8c60-5064-9c0d-3a469dbada8b", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:725bb01f-4300-5a48-8cb8-dabd0c0c6806", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bad466f9-196b-5fde-bccf-b2c9f59fb3bd", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:208de53e-e0e2-5957-a7e4-73ab85158f88", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0cb24f6f-ac30-5f74-821e-6952521722dc", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:75ab8c67-1b71-5b90-abbc-07c52ecbe1cc", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e8c0d6eb-753a-5e24-8dbf-b082287fb612", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0d13034a-91a4-5b17-915a-81d9f2fb2b26", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:72eb9860-a0d5-5837-9685-8ee87181584c", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e40ebaf2-305e-58c5-bbbd-23d9d75a8fed", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:cbed00b7-e595-55b1-9793-6ecd114332e3", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e2de4acb-1ac4-5c31-9257-9f66d640e6a1", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:912db55f-3a76-599b-8aea-d742b16d5a5e", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-orm. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fb1a6f29-3434-57c1-aee5-1ab6061fa45f", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a22c08d8-49b6-57d5-afb2-def87d99dc8f", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5f7e861e-1479-519e-a7b6-0628ef377b2c", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:55959943-fe99-5474-825b-88b97bbdd46f", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b80fabdd-f047-5dc8-b29b-61732b5c672e", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d7eaeed3-26c2-5663-8231-16fea202b88d", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:aa8c3e7f-718b-5a4f-9c11-083ad1164574", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6b8da9eb-78db-5e30-b2a6-425ffded303a", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3565540a-a66d-5379-958b-10713a01bc75", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a12b91f4-83e0-5175-928d-7dd4d85c31f8", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:293ee7ae-d0ab-5090-bcc9-c4d29c05d222", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:aba6f3a3-d601-5e07-88f5-bf9274bf2953", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:093866a0-b28b-58ca-b5bf-df072f68112a", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fbf157c2-d2d3-510b-af58-9578ed647309", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:28ae2933-04da-5758-a072-6a3fa7ca4257", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:34d8a0c5-b665-5e60-9e15-589897968b0e", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f4a44b4a-a4d3-5b46-b2b3-1add2473daa2", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0a4bc8c2-1058-5190-90fe-c1b4f6c4c69c", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:aea9e71e-e80d-5efb-8ba4-e680659bf685", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5d8d4391-76d0-524f-adde-7b35f1506709", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:359c6297-9b27-587b-bd3a-6e948dfad46b", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:dfce07a4-f754-50fc-9390-cf6280188bb9", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:da4c5541-74ee-54fa-94aa-afa992c35a01", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bb133e3d-7357-5fbf-8441-85cbbbc0939d", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:98686d25-a608-5f24-a4ce-4548b2d210d0", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d83983da-3c8c-52aa-8658-c65e0f790bd2", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:df096f9b-f699-5363-b94d-d7e68a0d0a34", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4fd509bc-69d5-512a-884b-fb7972214541", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.10" } ] }