{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4511062d-a9e3-54ed-b500-c537ebd15088", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14", "type": "library", "group": "org.springframework", "name": "spring", "version": "5.3.31-tuxcare.14", "purl": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c409f522-2087-5b84-9580-bec97e57d86f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:43f48779-03bc-5544-8049-7f27fa47568d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4cf7a921-a6d6-5513-8a4c-8fbd09ae481d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:3e12e4b6-ceb2-56b9-9df2-232a75a13462", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0d6358f4-35fd-5f92-a308-c5d7223d6512", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0e94ffea-c88f-5343-8c7b-8d8dc02522d7", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:46261b7b-6e55-58f2-9dce-90af4863fc75", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:ae4fe7ee-86b9-515e-9739-7b3fabf3f9a9", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:425f6d19-4c65-5bef-ac91-c51345b73bc1", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:fb49fe89-34f3-58bb-8862-75a08f5f9ff1", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:d13bd407-6a52-5f91-ae43-6f4d7efd28f2", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:06b87f95-62ee-5293-83d1-a369a3b369cd", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.31-tuxcare.14." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:e328c3f9-5815-5a83-905e-bdd8dcad29ef", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c5d7c24e-b83a-557f-9c8b-6e239cfdd89d", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:00d782fd-ea06-52ce-910c-11b4e16619b5", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:fcb8ad3e-28b1-5152-b121-48921fa4e993", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b7b20711-bca9-5666-b93d-014c06b9e189", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:3a1f7c20-1c6b-56d2-93b5-d29a63bbbf4d", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b04e23da-2eaf-5cf8-ab9a-2e8b11027e71", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:2b5bb4a0-9506-5303-a1a2-d47776d84684", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9c779582-0e30-56b2-9b1b-f75428e34bac", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b6b31a10-a8b7-583a-8437-673761a7cc02", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:97389fa0-2c1f-5e76-b57b-bf268f75631e", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.14 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:8f2c0a19-7612-5e09-be13-e29e7e389599", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4ffe70a4-cabc-5b03-85ab-8cd318b5f88d", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0d7e40b1-5b9f-5736-8f0e-3e7db98441be", "id": "CVE-2026-41843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:a92aa7a7-f7c9-5235-add4-9e731f30d0c0", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9a22cc79-3022-5483-8c72-ead6c492d242", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0b0496c5-14b6-59c0-90e1-4b4ee12dfb9e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9f829885-3fe6-5206-9d45-d5a26d0a6dfa", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:7016e611-292c-590b-985a-f9b7d2daca1e", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:d140af08-a878-550a-b6ef-6bcc5af30fe7", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:2e7cbd8b-6e33-5443-a493-6515e8850012", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:059c3bea-45b8-55f5-8b23-ec36fced4898", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:481655eb-c078-5553-89f5-d5e2108a86c6", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:dc6bbc1f-51a9-5e02-9b4b-9b24cb3f7a9b", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9412ba60-f9e7-55bd-a90c-f5094e65ae16", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0f74f88a-6a25-536b-b3b6-109539a71454", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4a371d23-607d-5a57-bded-2b70628b8a97", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:76420350-6692-5d13-b374-efed5e0943a5", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:7c57c180-a995-535b-9f77-8206b304143a", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:ef9001dd-3de7-5de5-8eee-4bd1958a5d78", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:8d0c2a44-7ad5-566c-a4a3-f88bf21717d2", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:802f34b7-c968-5d68-b2ca-cc4e0c11e9a9", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:bbd15447-f88b-56f0-b8f7-d98bf77694c8", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4d6d3201-0f49-5618-aa77-578964bf4063", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:19c3ccba-dd7d-546f-9324-26c52b089170", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:16e26dc7-8a9c-5a76-a1cf-455956182929", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:46b41519-74dc-5c5d-bded-97f43d6eca84", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:2370713c-34c2-51de-8dc5-97bdbf12ad56", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c26470db-2488-5226-bd80-09c82f510e26", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.31-tuxcare.14 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.14" } ] }