{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1df19a13-da2c-5c91-9b3e-8a529f11bf9e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9", "type": "library", "group": "org.springframework", "name": "spring", "version": "5.3.29-tuxcare.9", "purl": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ba324c6f-eaae-5019-af8b-6969ec7733ae", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d5f2a216-dad9-5e6f-a05d-319ab579061d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fb2f1e87-40be-56fe-aca9-8e9b6831feeb", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e268c0c1-004f-5c62-ac99-3854ba36808d", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:7d629e39-921f-56c3-9e5d-a4139ef69c4f", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c7d6861e-a87d-5d3c-8539-f2e676cab1e2", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b9ab85d0-e9e5-5aa6-8888-21743f452c34", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4c8de8d3-ce81-5009-81de-7f74c93bf5e1", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b76eda46-af04-51b4-bb41-5614dfc6010c", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d2f1523d-4495-5c27-b920-2011886514c9", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c04cf7f5-130f-5226-82f6-722a77d56784", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fbf5601a-4788-596a-a575-5c3d40cfbe07", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.29-tuxcare.9." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:45f24039-c847-5030-83b5-e7a678928c29", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d15f4ec8-4dfe-5aba-aa6e-22c1087022af", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:63f28db0-fbdb-55c5-b622-a77ee3ed1e4f", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bc2fc857-5806-59b9-a78b-4740961762f1", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4b03c38f-0f11-5461-ac9a-c4e75cfa448d", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5dab8db9-98ed-5382-b41f-6f266c7c6edd", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b54b261f-add6-5cdb-87bb-9daac48d730e", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ba5563fa-85bc-56e1-965e-06f193f5f7c6", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:f8bab7d1-93af-5520-9823-03b2fd85a117", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:89f6f06c-c1cc-578a-8ac3-3b425a114dda", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:673cfd14-33e7-5f1d-83b4-8dfed00278ef", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.9 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b58a7bd1-202c-5f2f-9e69-4ae54ce8d206", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:af90bb72-6245-515b-8e14-26b4083fd036", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:264d7179-c0df-5140-b2c9-ad5072aea639", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:25423e23-b40a-5802-87b6-272f288bcbf0", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:15a587ce-fc8b-57ba-a6e0-ba90c8ce052c", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:622ff1b4-359e-58de-9906-57210c7e359b", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a67c5a47-e1d5-5a3d-88d8-a769161ac3dd", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b30465d0-8436-5e54-8cdc-b916b4d33468", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3933e8c8-7316-5c1b-bf4f-c7907dbe63d6", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:00b6a153-0962-526d-b0c8-37528467e966", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:572af167-af69-5326-952a-7bd642a29679", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1da6f364-f410-512d-b87c-9953cb60e249", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:39a3fce1-0d90-5d68-9363-e18ac89f1932", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2a556a0a-a27f-558a-ab46-0343d82a04b5", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3cf4582d-97ea-5df4-9bd2-98daae570fb0", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2bd6e1fd-ef4a-544b-beb4-61cfc76221c1", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ab3c17d4-4f5c-5575-9b9a-0720ff809daf", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bc5448b0-119c-5ceb-9e2a-186ba8aa9c11", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8a935cd1-085e-5f02-84d3-0b601d1befea", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:9a09904f-41bb-56e6-b357-9df2f85ca69e", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:180601f9-5877-5768-9a27-f68c5bf3213a", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:9d79a648-31c9-5c79-a92a-66d83b03939a", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:462263f7-f1a0-5453-bf08-8b78f2f38739", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:966bcd93-2345-57be-a69e-d578d9bc287f", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3d8fb581-5e09-51a2-9752-e31f05105242", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dcf0e8fa-340d-5633-9f4b-a34bae8e07da", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:cd716d4b-5b3a-5d76-b75f-d5e130d175da", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2baaf197-6da3-50d4-9fd9-5eba91de5eea", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.29-tuxcare.9 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.29-tuxcare.9" } ] }