{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a5f5f156-a47f-505a-a9e2-62d950218a75", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2", "type": "library", "group": "org.springframework", "name": "spring-tx", "version": "5.3.27-tuxcare.2", "purl": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:cc5dac76-c06d-5135-9ced-aac7c15d1d25", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9c77f6a7-0bb2-52be-adb0-be28cac6841a", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c1d01d47-c365-5efd-bd6d-d2845e482118", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c6a7f181-5f2c-5cdb-a6d1-df462c7aa9f5", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5386cfee-e141-5a11-a514-17752deaa53c", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9c848fe4-97b3-5e57-b449-841bd53adedd", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e0a83ea6-1b81-5ce0-9af3-f2c036ccfa54", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8badbea0-1211-5b65-b5f8-830e211cb9ab", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fe882a10-b43d-5dff-bacc-c42ebd1c6f75", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6a288166-c334-5d49-bdb3-512619707d90", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:52debf79-4a4a-57ef-a870-f6c32b16b38e", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:88907758-dff2-5f20-aac2-8b34445455b3", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-tx 5.3.27-tuxcare.2." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f18e2a85-e671-5c52-9d0d-083fb9979099", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32a1c02c-bd0f-5de1-838a-1c67dcd1eb9d", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8979dad0-0948-5417-b450-719e327de9b1", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b2d8685b-9997-5834-b18a-12f066d233cc", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1063f7ae-1a32-54a4-b459-0e01ad5d9614", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:46b4a173-935a-5d68-be4c-53a3e57419b8", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ef00fb44-58d7-5285-ba36-b35ed7a3ab0c", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:827c8669-114e-5737-a94c-7628c94d1f20", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c127ce72-5cc8-5ee9-a8cc-8a96dc06cca6", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d2160320-3eea-5169-a787-ecf0851f1ffb", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f92cc421-5f6f-5f4d-b38d-e4eedc9a9d8a", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.2 of org.springframework:spring-tx. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:46ca11df-5191-5fbd-b362-520e2e452246", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2044876b-33a9-5db3-84e8-7d210b1cbb46", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2dc5d51b-69ff-512f-a303-e859ae812d10", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c6224dec-339c-5fc2-8587-ba207ffe0bd1", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4e1953fe-402f-5a6e-9d6c-2eeb25430ceb", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:28f009c1-270b-5afe-b343-041a9b028522", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:98bf6431-7d64-503c-9b1a-1ec65f0ed2b2", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.2 of org.springframework:spring-tx. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41847. The upstream commit 07ba95739bf4451742e4ee6b4d4b2d0ee5f701bf is present in the current branch, and source code inspection confirms the vulnerability has been patched." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d2982797-cb05-5f74-9afa-c7e96aba80fb", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c9de5a39-e508-5152-8781-dc1e9ae4ddfc", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:41a2529d-de8f-598c-9560-a664c4c92c4b", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6d2affa8-c7c8-590b-9233-00c923111836", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e0a7d3e8-69c7-549f-a12a-0af0c49f9167", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fce96124-b09d-5d85-b476-489c397f5551", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cf76929f-9a44-5cf8-b086-c6d38c1d3fa1", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.2 of org.springframework:spring-tx." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.27-tuxcare.2" } ] }