{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7298dba3-88f1-5638-97d0-6b2915510c2c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "5.3.31-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9238e5d4-dd4a-5729-b38f-913e3c838d64", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b2d6fedd-507d-5584-8c7b-0db7f03e2170", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:87218c54-5242-5396-9cdb-834a82dd6299", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:10988432-5ab2-5503-931a-fd7cf9524b61", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e1050028-83ad-56ea-8277-20cbdac8df5d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:58af214c-f153-59db-bfa5-add8385dfa56", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44bb12da-1faf-54c6-a88d-45bc1e982855", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fa6cbe6f-6cda-5d07-982d-cc2b94534926", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dee48d9c-1add-517d-9fca-8ecf39c61abd", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:76e16923-3620-5c67-9aad-41b1ae2dc6aa", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8bbfa529-fcd3-5e4c-bb2a-b121320b9d76", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:49784846-150c-5259-9d6e-c9f497b144fe", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-beans 5.3.31-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d27b14e4-36ba-5a4e-a9d4-b669eff40d5b", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:98f59672-6ae0-59bf-a946-f673dafe781e", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:27e9278e-7e19-5bf4-adf9-7beeb08acdfb", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7990c308-e49b-5f8d-8186-f3cb7e80a985", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c5cda359-0e99-5e9d-94c8-4c0983d3f893", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1a0412e8-5d1e-551b-a2f7-86d43bf674c5", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7c160a19-8177-533d-982b-efb88365a58d", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:154146d5-7b80-538d-bf70-839d68b1b6e9", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a55560c2-22f8-5928-908a-0792f4fcec86", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8cf287aa-fa39-59e5-ab87-b21e7f865c87", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6c009210-2d81-5d0a-9694-60dc3650ca7b", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.3 of org.springframework:spring-beans. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dd30742c-2b60-5111-ba71-d92a54a7437d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8e83a16d-d243-5dad-83fb-14e88cc2bc16", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:88adc1dc-d294-5456-8edc-fccd5323bc5e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:48f32c06-c92b-548c-863e-9bcdf56b090d", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:95505656-baa5-5042-b9e7-611ba8581132", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:71d0769c-5efb-53f6-91ae-60a04a1fe715", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b4933aeb-5158-5313-b8ac-fe88b1a76344", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a3023090-5868-53c4-a6df-52ae9b8bce10", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:78936278-53fa-5dc9-9491-e8407922c566", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4f52be75-ba7f-5152-8710-f7899a9ca6bc", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:543ed633-ecf3-5695-a172-646304c19043", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e506b27b-e77e-57e7-b7b7-4f02e268c9cf", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aedab17e-c73a-52a7-9ebe-87a52ec57a33", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:275a279a-da37-5879-8c8b-993533b6bedf", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.31-tuxcare.3 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.31-tuxcare.3" } ] }