{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d029cd04-96f1-5cad-91c3-cecf29a1d2f8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-context-indexer", "version": "5.3.27.tuxcare.1", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:34c94286-9149-5ba7-991e-5ee605abec32", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7d924982-db92-50eb-8e47-1f70e63e5419", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fbc87027-62cc-58dd-abb1-a3bedf2d0fcd", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5532a9a2-710b-599c-8a1e-5b3fcea22638", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e61988c6-4db2-54ce-be33-c1549922c231", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c6bf4ed5-f477-5c64-b7b4-26dd2d0c2fe6", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:254db6cd-f5e2-5f3a-9dc6-e4881afc8252", "id": "CVE-2024-38816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:edf7e9e3-f4c2-512b-9944-2f7b8e24ca24", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a55b1266-63bc-5551-a18e-ba3536011e47", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ddd4e026-2c6c-5432-826d-f216eb0bb54d", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5cfcdc1b-a6fc-5aa7-b7d6-b9deb826e7d2", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:db59ae15-699d-5250-a370-31c230c7b53c", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-context-indexer 5.3.27.tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c21b7715-825d-5584-808a-fb8fcc8142c8", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1f956794-ec32-53f5-b9f0-aecc52135ef7", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba5edf80-8364-5f03-84fe-1d7cf7524a5e", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:724111e1-8c66-55f2-8708-7ec2c8f4aa3c", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bafdba7c-f1e8-5fb4-b669-7a1e6dab51f2", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1809d519-da36-5b04-ae4d-91073a01447c", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:81b0e34f-8d02-53e7-a624-f20a4a007321", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ab4f233f-6146-5093-b4de-ab0a2826c3b6", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2ba11ef6-f76f-5ddd-9353-a61fdc33c78d", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9746a379-a492-533d-95a2-8bb0e1cb0dbf", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9e171689-6032-5b84-a40a-285273e97c54", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9e7f4c75-91c9-5849-b28b-5f747fe80b5c", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9757a511-56de-56e3-872b-55561d79d5f0", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b3304e04-1ca2-5bce-9010-02ae5f57f69f", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b8c30da5-b10b-5ec2-93d8-c621744e3bbd", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29b8a1c9-f21b-58ff-bc95-a9b654b8ac9d", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0e62a229-90ee-5f7c-9f61-2491742fda57", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f1a7fac-c060-513f-b289-94f4832ec762", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41847. The upstream commit 07ba95739bf4451742e4ee6b4d4b2d0ee5f701bf is present in the current branch, and source code inspection confirms the vulnerability has been patched." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9d4969c8-efa1-5c26-b36a-20e3a26f2275", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e0c3b1e3-8b85-51bb-a52d-344081c35a71", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ec2443a4-69f8-56ea-a36d-2ce91eb8d4ae", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b95863ba-447f-55fa-96e2-2c53a753e290", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b277404a-c807-56f0-ab19-1ad3bd5aff30", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ff562304-e171-5770-a925-a59ae6a4474c", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fcff9fe5-8aa6-5632-ba41-f9b8b2f3aa0f", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27.tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27.tuxcare.1" } ] }