{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eddb5e14-e862-54b2-ae83-f9b0cc9b4752", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9fdf9cc6-352a-584b-b6e6-b3b84b4e151e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f8678919-b3ec-5ad2-a235-6b862fc476b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:53302a37-237f-54f9-ba52-5e11be186d4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4d72d65a-8343-5192-ae9a-0d48b8865593", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:882a1d5e-c96c-594b-9488-981366418da7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c71ad1ae-be33-5fd4-a7bc-0cdd53ca6a80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:05d2fd96-e944-5b13-b6b9-a639ffb281e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3f7552b7-ae48-5483-9b82-70bfb5e816ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a419e731-cecd-5ba1-8fc9-1d93dc9d40af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:71fc2ab0-18ba-5604-a098-4c58da786e64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:336f1820-5791-540c-b160-68d1e28887f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c61c0ed8-ee69-58b4-881d-d7a9e3799aca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:eb5a0822-0c05-5f7f-b790-66a89674db36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0fd19f0d-47d2-586f-9934-1724ebf50260", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f22500e6-e84d-58b2-b780-566aebdf83ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:95b724b6-ed6e-541d-a297-8f446fcc26cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:62196a47-935c-5d8b-874f-0167ad053bdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:42396e29-a9e0-53c1-bdef-d0b71e6d4331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1ebd4b87-40dc-5efb-bcc3-3abf9e18dc70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:979926dd-20e3-5ffa-8b65-47e4f2ea0d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:aca7abec-2e6e-55a4-8203-beb77a4c37f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:05213535-74e4-5442-8082-7595253557b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7e1accd5-1939-5ba8-907e-a8696b30a488", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bfaa4956-35d9-5c27-9436-03dd96eba32f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f3890f79-adcf-597a-ac99-8c059d5a8078", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d83a8a5b-029b-5cc5-86a6-a02007d71944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9d88c365-6f05-56bd-a9d3-021f34ba8a69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7955c24c-bdee-5e5c-85a1-fe3695b0abc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e059c5bd-60a3-52f0-87de-e15fcc024538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8827341b-a7eb-5965-bd93-d9c9590bc3f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:28d8167f-3422-5c96-af69-8d88bb09eb51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c7010ccd-40dc-57fd-b3da-0ad823d36f03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:52027a21-258b-5c48-a5be-3f4bd702146a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5a81edcd-2e1e-59b0-9c56-5e68390f777c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:11d23ed3-20b1-5006-a636-cd746791c60e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c7e78697-9ff7-523d-a770-df2f6d711374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:51aa8103-0fc6-53ca-9667-6959ffb73620", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6ced5b4e-340f-5ffe-b800-572cad805b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f590b700-8540-5416-a4e1-757e91d6fa52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:485eb492-85ba-56c3-9091-3e10e9b8da53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c184659e-a9ba-5a94-a842-20c65dc8fcb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8a0aa2db-472d-543d-af0d-ba9d87043198", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:81af9c50-1c7d-53c0-aa8f-d3771c22afa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:481914ca-3bee-5947-81ad-818dda08dbec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ba24f1bc-2d57-57ab-b96e-5e81de729c42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:15a5f81b-a6ce-5317-bf0e-2ba5b97ba85f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5ab84d96-2973-5a0f-a94b-4af9a1b3f79a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b9a406f7-8479-5fac-827d-c8584d085654", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:606c3bca-1900-5010-8421-84e24e7cd451", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5ce49b5f-5feb-59cf-9d0a-43b3cc46e53e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.30-tuxcare.11" } ] }