{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6f90e9c1-b2c6-5f67-9b53-1570037e8ccb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fc77ef90-582c-5254-8386-1ff831f0f203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0a6e6b1d-3328-5087-b3ce-3c2f1c9e5352", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:51013faf-4467-5133-a4b0-071c33ee1e85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:79ac6a71-9a8f-5da5-9f21-92dc71d99867", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:35092102-9f1b-5fe5-aa99-131a1034aa95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:96aaa32f-d01c-5f9e-978d-c32c8c036a0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b0adc6a6-ea79-54b0-88af-e66383b844e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e705d63d-43c0-562d-b196-db1b3d7793c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:af7b7628-666a-52a2-adc3-baa0784fc4c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:236f17be-0902-57ba-b25c-06d5d82a3620", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:69d3891f-61ee-5b56-931f-fe2d43cdcb17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f0fc2398-4bca-5c0e-88e7-9d98aa4a2bd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c6ebc23f-42b7-57d0-bd2d-19cae764d137", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0831cab5-b709-59c7-91d6-43e21d4c1f0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f1e60b32-484d-5878-a983-f78faf6799c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2e26b2c9-56a5-5646-9121-54667d642ed3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e8ce64e4-d9ca-5507-958c-24036a12720b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3da2fad6-08ef-51ca-a83f-a1419edb49c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:24368eef-5d2e-5203-9a1c-f17ef7f4c944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3e260c75-8d24-54f9-a655-ef2f3bf63cdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:63c5d8ac-fd18-5faa-aa26-12bf6faeb669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5a6389fe-55a6-5781-a3dd-7bad77d94452", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-orm. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:48996b24-381c-5615-b4e8-09a565a5ead4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d8cc86d5-939b-52e0-a083-db8d13f50bfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d01bd91e-f748-57a2-9753-54f82377156e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a741078d-ccc7-579c-a433-b4320fb01bb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fc0f01d7-87f8-5cec-a063-7afa5a28f601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8be83e22-767c-521f-8516-d4f6ce5999ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:83054497-e9ba-5a94-9a43-c4ba44739870", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e24a15c5-d4aa-552d-afc0-036bafa64f21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:10547cd3-bcef-57ec-9110-e87e25d7003c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:633aa7aa-1502-5f65-a141-0c962cd55af3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:00bc469e-0ad5-5ca8-9730-f6bb28e4a1a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:67f6ef26-c816-5060-b250-e76c89f33bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:29c9a945-1f6a-58ef-b6e7-5ad7d6c77b1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ba8a33a0-3ceb-5e87-9b7d-dbc99c5dc2d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2f26143e-fff7-59fb-aefd-7590a0ce1e3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1aee2ea0-28e1-5ab3-a5db-a34d265e7ea3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:04572178-e832-597f-a788-11c4f6c46947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2256fb8d-e538-5c7e-a343-3f5cc41a6a2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4af92938-e16e-5884-a537-5cfc1b483b14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:cc487187-617c-5fcc-b168-8b6b8746b37b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2f04cee5-d80b-522d-ad51-c4e0f7bd1bfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:02b195fd-86a8-5751-a78f-391c8b1166fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:921d5875-a5a6-5186-89ea-328de8524b17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3cf9051b-a019-5b81-85ef-4c54358e0545", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c6ad0c7e-8bea-5bd9-a486-93dd099e9330", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5f6d3e95-3387-5104-a9f1-65a806ea531b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:464d9d2b-6eea-5f42-8867-7c95fcefbc89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fcef2688-4358-5fb9-aee7-862780f7e80c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.30-tuxcare.11" } ] }