{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:867f7374-bd21-5785-afb6-c715e4e9c32f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "5.3.30-tuxcare.9", "purl": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:db81efa8-2b70-5f24-be39-7cc0364285a6", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:60e65683-16c6-5f18-bf79-811d0eb6d719", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:70f274d3-3b64-51db-8955-e5a59bf8fd06", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c9598552-2f77-5755-a824-df2b87fc5916", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c96031e7-fa66-517e-ab3f-1320518436b5", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5c7b2aa8-afbd-5120-8f7b-ff80622838f6", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:50601a3f-1840-5729-8d98-c6206479bfce", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fff65edb-1240-512f-8e7a-8cc06f5f87b3", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f539bc47-44d9-56ad-af2f-436aab08b4bb", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1f90f235-6377-55d0-9c29-4e30bd3df46b", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d00d94c6-8da2-58d3-a0da-15a90591239f", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fc9e19d0-bc34-5a59-a4a0-d6401813b48a", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1a8aace5-8116-56dd-85f1-cc405a195138", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c1971aea-fa2a-56d6-acdb-5cd963baa06c", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:44813f74-6e12-57e4-83a9-31a0e36cbde1", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1393cfb4-db99-55c4-b97a-3dc30cbac2d0", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e927dddd-f770-561a-9847-fa5fdeaca2e6", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4a312756-259c-5971-a653-b5a4466b991b", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a077e73c-d615-5271-8f6d-700ae97d839c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f4f48376-cd2f-5571-9e18-05b9f3f74bdc", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f0997328-05d9-5d68-af34-54de8b9b15ab", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:53887447-0975-5119-95ff-b96285dd671e", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.9 of org.springframework:spring-web. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2574a0f0-c68f-5426-9d92-d0f5b2c7c545", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1f507897-db7e-5bbe-b648-597adde28c84", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dfeb8b66-2fcb-518e-9bc1-826c1f530d06", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6dd5db16-9467-5961-b78c-08a49af3c93f", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:568fa96b-afa7-5b75-84dc-a6fc077eeb54", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:148539e4-2d4f-5bc2-95b2-08a959a9948d", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bb5cb3e3-ddbf-517d-9bde-533541730085", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:00e7da2e-217c-56ec-8160-711923d6235e", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d120ab19-e138-5485-a7e4-ca33528fbf4c", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:21161612-fd5c-5f73-aa28-1f3aee2d3884", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:06cba5f5-51ab-5783-9d2c-fedc0ae39798", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a551bf10-5018-5039-9ca3-66f2c183eb0b", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:584f00f1-6119-54c7-8f8a-452e630db188", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:331e9dea-724a-57ac-8fb3-dfe4e6bab357", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:59e9ac42-d73d-5956-9cd4-343aae6c8ca4", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:75a70ad7-afc3-55cc-9b39-1ad50ccf6c59", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:51f40e27-df4f-5242-b688-6e3ab50e294a", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:31a64a42-093a-5a84-ad4d-3776ecf2486a", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3986d099-f392-5a29-aa2f-5c1a23876302", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6cefefe4-7ba5-5ad2-9243-4cb8e4967355", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ad8da9f1-b0e7-532b-a428-6692271562b7", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5fe31367-e9bb-50bc-bf38-477a6affe7af", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0e7d437e-986d-5eab-894a-f411a3149675", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6280cd33-a545-5a95-bb7f-0e4486386776", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ad8217df-0175-5266-8e04-deb1de380f48", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a3c9ebcf-ade1-530b-b2aa-4026408cae63", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8e96399f-2c93-5f2e-b5ce-8024fea73f61", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:50ec5398-ddac-5711-9732-0a4ee1973cd2", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.30-tuxcare.9 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.30-tuxcare.9" } ] }