{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8b392eba-4ba7-5820-ab11-8d46caa12391", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e6d3122d-0d8e-5ec2-a262-50080c8934fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-context-support and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0dad90d7-79a3-5476-98f9-5f4b19a82b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:cd8e10dc-1941-5d4d-a255-cb0ab14417be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f2e94323-b2c5-5728-ad8b-39cb0cd7cbd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fccd22bf-23ce-5bb5-9b1f-95f0fc33cbf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c8069074-ef0f-53a7-a833-eb109edb3500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:54f19f16-6986-554f-afa4-d0801710e6a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f009c80b-0d95-533e-8daa-667481611c37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4054389f-aad2-50a5-b587-99e2d6025479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:68b40697-3e7e-5e55-9c0b-9d8bfb74b862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bc97a550-9e49-5ebc-b531-5a089b28440a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:064f7f48-bedb-5b53-8fb1-7088b975f31b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6bc70862-14ca-5f28-842b-a71c6e7cb326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a46abd1f-acb7-5168-ad90-547e1099e114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:06e2632f-dc20-57fa-835d-2051098567d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:99972965-8200-51de-9f14-096b65a83f31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5aa763ce-8e5e-525f-991b-e2d5f004712a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:276a1183-defa-5efb-b5b0-447211e8ab2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fe234080-f2a9-5c51-bdea-c4b44057d7bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:20351593-da77-52a8-bb48-bc43aee88eca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5a0af303-7f93-517d-b625-abc9b59a2181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fdec8bf8-0af1-50de-a88a-f4407fd4ad23", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-context-support. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f38d7a3c-420d-51ff-804c-bf81edcf0cc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ed3f21e9-f763-5dad-b634-f2d1a2c4af5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ef7312d5-443b-5f0c-a59d-aae2c7c49f86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c6490ba8-1ef0-5ef4-84b3-0c6af88e8914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4f43ab3a-c71e-53a3-b809-a8b5d4794f8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9c24af45-c77e-5d10-aab5-24809a03518c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4d1b449d-f6f5-5927-bf0c-d3855108c78c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5b50a4f4-ec90-5e37-9ac2-2d4c27cb85c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:daf811a9-eb1d-5ec3-adb6-bb482a2b3229", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:de7e4f5a-f906-5fd8-901d-9e58d11365c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b67ae98e-d1c1-5eca-8600-f000909cc1bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:25c2d383-0a83-51b6-9af0-caef445aab87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:767353ef-f36c-59c8-b6da-363ae06f0aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:449c0913-5e34-5060-b886-d3ce66f3fbef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b8dabc38-c135-5a31-91aa-83e81be04ed9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b6f792b4-668d-5a66-853e-1fc74859d970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ce278380-e02d-5b22-b7e4-8a1731fc3cf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bbca3234-5c7b-53b1-a58c-5cd3e40940f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b9df7611-9cac-520d-a4e9-b953ff886c79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3c64cee7-ab76-5118-916a-ad1348b2cdaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0759692c-b8a1-56bc-8536-4c8b31ad85c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:535b46c4-3d1e-5c6e-8fe9-595f07ed4b98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:09aa4eef-de40-5958-a3df-5a79c11db66e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e48cbec4-0314-5f47-8f2b-623009e2687b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:958d65bb-25a5-53f6-b259-bd9f67d32186", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1beed78b-5adf-562e-89b6-cc7e247d8dc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e7201677-4f56-57fc-bde2-00eb0c13ad16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9f854db1-ee58-5bd2-bc9b-58594a9ca3b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.30-tuxcare.11" } ] }