{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:82862043-9616-5f03-b492-c23d708f8cb5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "5.3.39-tuxcare.9", "purl": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5b17b555-9528-5f2f-8dd6-96411cf11b79", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:50112110-282c-5c8d-a51a-152c5fe3e559", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.9 of org.springframework:spring-orm. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2f422682-0e85-5c25-99d6-ccffa1672094", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:566dbb91-bbc2-5030-aa50-2ca5037a3f48", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b83847ed-9b88-5025-ba8c-55d1ed894290", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0977baf3-e533-5a78-8c26-e8a8d1894185", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fb80947a-2d2b-54fa-9abf-84b000cd431a", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6577b464-d973-5302-8971-850f34285fb3", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-orm 5.3.39-tuxcare.9." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1c3a57ba-bc7c-5dcc-98f5-92776a58fb18", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:66dba75e-1722-5fa0-869a-f95531a07c57", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:9c441a6a-ed29-5190-91c5-6d2742330403", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:648e1019-2989-5ff0-83aa-9b264ee83450", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5ed6ebf5-1763-5c7b-aef2-c8e0f9a42869", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b2143957-1a72-55f7-a64b-fdc5b46164ff", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:00621db1-2abf-560f-8da1-f5f1f3e3c772", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:37607f98-1ca1-5a47-9a85-84cb9576bfd0", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:32c8842d-8904-5c24-bda8-80df8e17390b", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:98feb932-0135-5f50-8e54-1f5578f56062", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6586adf0-dede-5fe7-811e-41794129c1ed", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.9 of org.springframework:spring-orm. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:43f24b7f-6e2c-5b50-b96a-c71835e364f8", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8fa9bea8-ef02-5d15-87d4-420f80b7c79d", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8968a885-a9bc-51ea-8ab1-4b9379fd56f1", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ca2ec6b4-1b7d-5179-b389-cf57c8d01b7d", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:7f4e4ace-dc89-57f9-ad5c-9a9281f79440", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c149495d-d2d8-5a9b-8611-4dcddd1b72ae", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4300fd70-a310-5f60-b196-bd3c068e4a9f", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5e86b13c-8621-595d-bf12-0ec18d7d23cf", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d0023b93-5031-5c90-9b33-02db5d175119", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:093ff0e4-f247-5c93-9799-56d6511f2ee8", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:617166fb-b764-50cf-b52c-54992d11ebc0", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e3a0d95e-3006-53ab-b244-45efeb431819", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0ba76439-ab99-59e1-bd65-d022ec369b6e", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b0a0eb9e-91e3-5bef-9b5e-e086058b2f3c", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.39-tuxcare.9 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.39-tuxcare.9" } ] }