{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cd767cb0-6335-55e3-9006-265754b4901f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e7b00d85-01bf-5111-8915-3e01d55f83f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-beans and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:62f9e87a-2fa6-562f-bda2-a214dc806775", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:762dc4e4-70b0-5ea5-a0f2-4111018e22e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:853a5c44-19fa-5f71-bab1-d0a336caef2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:efc95e75-c5ea-53d7-9d97-9950f9925db6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1d163062-7854-5b60-8316-71ff0dec924b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ef9750a5-43bd-59c7-8dff-7c5dbe7a9271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:32c12f01-1224-5187-bc6b-3a6230670e61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6ec92667-f0bf-57a4-969b-9de4a22e5604", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f3a15b56-30a8-5d98-92d7-937f942d8fbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:cd07cb5a-edb3-5bb8-a9dc-bcf48eb3ae2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:37eab020-d18c-5b8f-8612-1c1c667a2287", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:713599d5-8927-50f2-884c-94bbb597a164", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2c00a8f1-ee41-51c8-9b2a-6d0cd68c6184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:302b56c0-e204-5158-8146-19282acf12d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e64158e6-28f3-5903-9dd3-318c7a76a2a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5f4c7635-119c-5fb9-98e7-375a186373fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:448f68ac-2fc5-576d-8e8f-cbe852606618", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d37f76f1-3d41-5667-bddd-4afb722e78a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:682e9e26-0e87-57be-9280-4f7e973d2db0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:36d4f28b-7d41-50c3-8315-618e05e8bd99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5dd07256-e3c9-5c84-8ffa-f14e056e22c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-beans. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1dcf53a2-e0f0-571d-9522-84f67a711c27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7596b3a8-1827-5a5b-8ff1-028acde06cdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:01087a6e-a043-58aa-a114-175e1d3744f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f7e05450-5759-5efb-9875-5c9ad8689a56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7fbb63c8-7dcc-511f-a9f8-f94790fc39b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:dcd4f1c2-6f7c-549e-9460-06a9b9d08739", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:80ac4c37-ec5f-5899-91f2-c39cdceecc83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:53081ecc-9fbe-5923-a6b6-cdd708130880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1437c3d7-048c-516c-ab94-8b60081650d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2ef6019c-8ff2-5b02-9f06-5466751d7ae0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:35102c46-0bf2-5d69-9a92-f803e31b006d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4707585f-2bee-5829-8330-8826129c0c54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:411010e0-6bb9-5eca-b7df-9f562233942f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4d6ddde7-2613-54f0-8717-2cbeb07a1930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:798255ff-d201-500a-a042-dbbdf57a070c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:37fb7939-e252-59f7-9f72-981a5343d7aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:87c04708-8511-5027-be10-a24903a98558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8789d2a3-4ae8-58c2-97b9-3bb40f32174a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:73b70ab6-c0e7-5ce6-b85f-1a1e44a503a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a6ea2ff8-9dfd-564a-b8b9-cb59d995638d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:df37a1b7-bd10-583d-9bea-e938465babba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4e865206-1eb8-5306-a3f3-b2682fcda892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:73893baf-787e-5570-8dfa-db4b0dd57a87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6df086ec-51b4-519d-bcff-e64c073206c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6a9aa137-6f1b-5bc4-bb92-95a0048a50bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:27c9a6a3-9a47-5333-8926-679fc9cfcf14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:742947d7-acab-55b0-9aab-91f272677b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1eba4a46-ac86-575f-b965-4fc5860ef60e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.30-tuxcare.11" } ] }