{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5ef92079-657b-5a6b-a2ab-be8ef4a49710", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3fa2405f-be1d-5c36-8702-b5b33bcd3317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:88f16971-d9c5-5a61-b1c4-cd8cf99c8b4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:80ef14c1-0832-52cc-98b7-e16d081ffe25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:12390cd0-1bbf-5245-8602-60fd27234091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b63843ec-4a7a-53d7-a009-1340d1405632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:24b5c4cb-2b74-52cd-bcdb-37db403caa3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1e6fa66b-5063-569a-b05b-6b9a8735a22e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:549e4cf7-2c0d-5891-ac07-a192ecef60d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bbfceaf4-7223-5562-a3ff-2bdc3c273614", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:324454fa-5d39-56a6-93ec-39280427254b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b708f007-52e8-5df3-a548-07fa95ad08f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:93cc6f2f-771d-52c8-894f-78e03d4a64d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:04372784-a141-5269-9b85-f60fb1a36a90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:177e9724-7743-5b31-8fa4-e650688f02b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7337041d-d546-5fba-952a-acfa42ee345b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2037569f-bb9f-5b3d-aae7-8106e962ebd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c59b4b54-5cb3-5c47-8515-943f5f6e1892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1b57c343-0b61-59ae-8fff-03333bdc4fc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:90eea5af-b53d-5ef5-b1e2-a4e632010632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5a0066f0-f6d6-59cb-87dd-a81efb933c18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8b474248-f6e2-55d2-8cb5-41cf36b8c3bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f3933205-9f63-53ba-85b0-a29a86149772", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d8dc424e-23c9-5a05-8a8a-b4759aea2ca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8a0edc70-b4a0-5510-9fce-38f05c53b792", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ea83708e-f272-5c7e-b1b0-bf33b34248e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e094f674-e8e1-50f5-aee9-753b6aa45f73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:783a05a0-0703-5fdd-bb6e-6b1ae413362b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d7696ed8-a1bc-5a25-9d89-676270f9c37f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:635b019c-1ec2-583b-862d-93a896ca10d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2dec8d2e-2755-53a8-ba59-85b6df0cb9f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bce064ba-1fdb-50e6-ab7d-3bd8256dfda1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0b4ba891-0dc3-5f81-8434-210d50c8ecc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d854a604-e78e-52e1-b2a1-c76dfe5914ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fb747448-2f24-5fa4-a4e2-2aa799e83b8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bfb5716d-7e31-5fdf-9102-b887c5683c7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f4adcc0f-b70b-5954-9e16-85bf24ff7d83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5adbb658-723b-58e5-a7af-58f72cc3c2cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e8474dda-f463-558a-9b49-71c341b658aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:573f29a7-b9b2-5713-a1f6-dd09111777f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:80d66570-098e-5713-801b-0b3c189d67ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:48de9822-a983-51da-8e97-1a63785583c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:be4b1640-2810-5346-b981-a4430799dda6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8ef7523b-ced1-5888-b293-e236f46ad9f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e2e1ac4e-e1e5-56c8-9d77-135ec3d30280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b0b3890d-005a-5c88-9d3f-c19ad0f3dfb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8a82e180-bfd6-5af2-b839-67a846a077ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:688980fb-9ea7-5808-95a9-96deab64a97b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9fb26499-da8b-561c-a6cf-ba9d184f651c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2d530ec1-fd50-5780-859c-cfefb89f4eb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d6681275-538f-5e85-9dd5-f9cd9f1f51e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.30-tuxcare.11" } ] }