{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:203a8647-679e-5fba-b70b-d133fff83301", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "5.3.30-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5c11e9b0-0c7d-54ea-ac07-b52a13b89713", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:45dfa1ae-68e5-55e3-86b2-5711b1da404b", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fe80409d-152c-5b1c-853f-5d60b396e678", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d2585f2f-5c6e-58e3-a3b9-a0a1a9e3065b", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ba5e2fa7-1653-5e5f-a7e8-d2352356383d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:92308bd8-cda1-52dd-97c2-f6f8ae11673a", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b29ff831-b7ec-5a67-a7c9-10c7858d2111", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a5d09e1a-4c41-5d17-a306-05d599874b4d", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:25c58007-b025-5ef4-adeb-84d4d514a4f8", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7ce67c43-c2af-5161-8a04-dc293c348137", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e9f5ceae-2e9b-5f15-8f15-9773d73bc110", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8dea2947-9806-5dad-85ef-55d984f58b7c", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0b44a237-41ce-55d9-b11e-68663e81d002", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4f0281aa-0b27-5639-b10d-426b68740e69", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9a54f5a5-1b8a-5a8d-add9-5975f57e750e", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c6d141f0-1ab8-5bee-b181-5c581c94f152", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:72be4166-4471-5c7c-a5d4-3a1fb30224e5", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:dfcf4a65-c1da-5f5c-bc0d-b8e4c34902fd", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9e0f1117-6825-59b5-90c2-b830dbe0afe6", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b9eea79c-5520-514f-88d9-fb867cdfbf05", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3c1c93b9-9e88-56d4-8a6a-84a10564f43c", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1befa8b9-aae1-5f6e-9a49-89387d4261cb", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-web. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8645bb9c-ddf8-56c4-9a1b-8e47bcc1b33e", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:88dc653d-5c13-5e7c-9c48-3d5678fe5f1d", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1423a9ba-78ae-57ab-8ec0-385b8f9e9f88", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d088ec9c-7a87-5dde-9d9b-829c677e8af1", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:71021f47-4cb2-5733-8b3b-edd827e601ce", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6f77fcd4-8d93-55c8-9e86-af951ca04f60", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d02bf2be-6a1b-506e-b87a-a7c3b26f9e04", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:783a8a07-bc84-51e0-8c5d-c786f1d2fcc9", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:670cf52f-2567-5e3e-8e83-c26f95362519", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:db87790e-cc1d-5dbb-beb5-1ce296bcb38c", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7b20b27f-faaf-5827-833a-d5d120f2cb9c", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d291a015-b504-5ef9-9334-3a6d148c7512", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9f1722d0-8034-5b9b-b5c2-c5f367352ab2", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:52dd0502-2cf7-5015-b4d3-98b5c67b3cb4", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bc04d977-d5bc-568e-b70d-0d14956abd25", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a2402991-a884-5795-a052-70ca20b07737", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:42f23f97-af25-5e27-8d18-885d403a1d3a", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:edaeb5f5-7dd2-542a-9ec2-3911b8013e5b", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e6079a51-ddca-5d61-9d53-6d93dce35a29", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3e670269-97e0-5fbe-b48c-3eb5faf3e2dd", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:151931ba-fd38-5c0b-b633-e3fdabd8833c", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1aa47699-3e65-5d10-85ad-620a2a70772c", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:803cf525-9b77-525d-b366-752848bed58a", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fc22c523-09a1-5da1-bcd9-4e265d8345c8", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d3299e40-f5ba-5140-9af3-5bb6b3e3d212", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c97776c2-9b82-5044-8b80-f82b90a6427c", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:42471873-4fdb-55ae-826e-f28dce7013e2", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e43f17f7-a42a-5481-a517-85dc22003b86", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.10" } ] }