{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c221442-4f84-551e-ae00-572ebe828273", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "5.3.31-tuxcare.2", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3ff3ae66-aaa5-5dce-88fb-163e7cf9ccda", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:630ae671-f018-5c0e-880b-dea9cfda3db6", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:43ae9414-d817-58e6-8165-507db0b830fc", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aaadb50f-43e3-5b97-acb3-e64e4dd56b20", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1a339d7a-4f07-51bd-aa50-bf118a7090b2", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:06ea5dce-7829-593c-be09-ecf21b8aea7a", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2cdf3ddf-57ae-50f2-9f93-793ad5e39ae0", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:564a8bd8-a649-5d2e-ac5c-cab769e3a4da", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7f4336a6-475b-59bf-92ca-7f6b2ceb9016", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c4e8be06-9d8c-521d-83fe-f77070490afc", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:97faaa2f-1461-535b-bfd5-7d28ac2a2408", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a3261c0c-fcdb-531b-90de-05ee08a3096e", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-oxm 5.3.31-tuxcare.2." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:04d6dc9e-eed0-5f9d-80dc-8908dbd10982", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:659f82b8-e5b2-59fb-a3bf-9f1d23432e70", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0a805ddd-a278-5eb9-8c33-754caa317d51", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:430f4e93-272a-5f1a-a392-4f4f1192c40e", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:83b19459-6950-5e70-8d77-17dbdcdda574", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c2f5dfe8-fb18-5727-bb9a-5ba31d16c521", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc6e07a6-fc3e-5590-9be2-d479a45474a8", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:21b06fd7-1059-5951-a55c-34cfa8d6d0d4", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6c30212d-5a8a-552b-9b7b-d71ab02f269f", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:256a4b32-b2ba-505d-84bf-6d80368ae123", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7fc5c3b3-9ae7-5f3a-a178-c77f23f991c8", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.2 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3f7b1223-393a-58e6-bf02-7d01dbd88be5", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b6ec8557-36cb-5eac-8483-806ee68cfc16", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:56843b38-7486-57f5-b32e-75667ff099bd", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4691eb04-0b71-51cf-9113-794cd60a12ea", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0d8bfca2-1c8d-5846-82a0-bb62600f0331", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5960e45-4c8f-5305-91fa-30d59b0908eb", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:74077b38-5dfa-5b37-9528-bab256997508", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3c97a6b6-d50d-5cde-a4ed-61c97cbd22cf", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c1b2fd81-688a-5968-9965-bfab9e88f752", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e44e7e34-0717-5a01-b52e-2b4e2534de5a", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c7d9da34-4eb6-5de3-89fa-829981086fc7", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8c90d6e9-8af7-5645-a1ca-d2d4656c9de2", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e417a585-61ed-5377-ac8e-67e95c753730", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3e8dc647-c556-52df-b4ef-987f3791ebce", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.31-tuxcare.2 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.2" } ] }