{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d9be6a67-9bc5-501e-a18a-e88ed95823a8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "5.3.27.tuxcare.1", "purl": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b635c62a-71ea-5990-90eb-0b4c9f85ffa6", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:081ffe53-45b1-504a-baea-fccc5397cc78", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4f4a9298-1fe8-50c1-9854-69a1a5de5425", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:54926b3a-9963-50e1-89cc-603a3f21fd8f", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b08568ec-c13b-5b27-8eca-802a98964c67", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:66d01739-9070-5fac-aa97-77e7bd1e2fdf", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1094a61b-9d0c-5189-a523-de9e71b7ca8f", "id": "CVE-2024-38816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f97ec5d-1117-5a8b-92b1-6a66e26c60cb", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:494e19b0-deaa-5155-8c61-bf5f63644391", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:18882d50-43cb-5fa8-9471-54e903d2fe8d", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f3b3caa0-c792-5a72-8cfd-c74d789d7351", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bdb54135-186d-5e49-ba7a-bdcbc6c59745", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-orm 5.3.27.tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:28721b30-1613-56f4-b4d2-a8601b1b277f", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f2fcaff-112c-5c7d-841b-c9f8593fa7d3", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:31f725de-53fc-5446-8619-5f2348272e14", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cac97c55-69a3-599a-ae6c-8864ac9be076", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1f80b803-dff5-5046-aad9-6805a41ef09e", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bae62010-9f31-55b4-9ffc-19e5db37c24f", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fe89699c-a3ae-5bb3-9feb-b8383e6554b6", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5a741db6-8771-5280-91e2-10e5f65279f6", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2c210e30-ee5c-5a50-921e-39934b0330a7", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f6ccac65-3aa2-5e65-b824-f04dd76405b2", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:556209b3-2d38-5606-89dc-788b88cd2986", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27.tuxcare.1 of org.springframework:spring-orm. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2dcb2e54-3c11-5caf-95f1-e1681c32871d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7b4f85cf-126e-5b3d-9e32-8d99fa6d660f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d06f5751-62c3-5b64-8557-91907b74cdd1", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a0854bed-a194-53f1-9762-97664ebb0d35", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3b4d26ad-220c-5c25-b9e8-74fa2c1e11a1", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee39c4b8-e5e2-5121-9c2b-23fd550ca9ca", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d7f7830c-121d-58fa-b016-9d5fd7d59a8f", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27.tuxcare.1 of org.springframework:spring-orm. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41847. The upstream commit 07ba95739bf4451742e4ee6b4d4b2d0ee5f701bf is present in the current branch, and source code inspection confirms the vulnerability has been patched." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bd3da40c-c7cf-5108-a8d0-884927c1c71d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6329be98-2a5e-5f45-b36e-de2a04203986", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bc0efca4-caf6-55ef-ad9e-35505b01f9a3", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:356e947f-57bb-503a-8a6c-41c1c96b5831", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4664ee75-5cc8-5ab0-ad83-d4200c282d36", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bf3d3f49-f571-5b51-851a-c433f9d5a84f", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7297b4d7-ac6b-5c4a-bb99-1697aef4dfac", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27.tuxcare.1 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.27.tuxcare.1" } ] }