{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0abc2e2e-82db-5144-bb25-6918a13b617d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fb254047-035b-5793-9d93-44a3765858ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-tx and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:46e6f617-17db-5caf-875e-ee93a53f280f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2410688b-a87d-5e2a-8671-e9f5a7831070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3ed0e1b7-c57d-5bf1-8405-23dcaba47a13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:602f7c38-a8de-5876-913a-eaafd0ca6f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b092170f-3485-5488-a70e-3b9fd37cbecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:315bf69a-4e13-58a6-a77b-cfde72a63960", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:71096e8f-8926-5c82-990c-679580c479a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6cc5ac13-bc58-550b-8ace-b46cf947630c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8834d6bc-e11c-57e9-82dc-e0ddc17d8423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1b976967-516c-5a0a-b8c0-7e9604560574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2c0dd032-0763-528b-8ca6-ff038da7aab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:af96e056-94c7-5ec5-ad19-41ab1565aaaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7fc65431-9510-5fcc-8a21-24bae087304f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7e078ea0-8372-51bc-b82e-5e9bb8e7e368", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6374fc79-93f9-5827-9f8b-dc26f48f5b14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:847727fd-a957-51eb-8c1d-4938b764ac30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:dadf686e-686c-5865-b14b-d2e9b47be273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3eeec06d-e5c4-5f95-8d8f-1981a8354d56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:44ad137a-11b5-5f9d-81dc-43066b1b5d9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:68fb30bc-8086-59c9-bef4-55faec8866fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:19c7e77b-0596-536d-9c7f-acbf9fe3ea24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-tx. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:60b7321a-08a2-5717-892c-f6b56a7f11bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1493d041-7939-5cd1-8026-85da121ef27d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:716c307f-fd09-54fa-9a6b-89c36ad1a657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5b7ae85d-5017-52e5-b283-b099d09c47f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ac5119b1-3dbd-51a3-a0e2-28241caa30a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c7461b7f-f3fa-5118-aac0-ae091073a7f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:77dc5096-2b42-5704-9978-0a41ba68487e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bf1dfc5f-a302-5e9a-8684-9dba24ba2f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:88b65139-6a24-5682-9dc4-2505e2c586a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ad2f4ddf-b041-5e1d-bff9-fbb914c527eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:40914839-7da4-53ed-9ea4-815b38466878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0442d163-a06c-5030-b82b-f48580ffd8ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0d8139a6-6ba0-5892-a3bc-f1e956b39429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:28df86bb-7513-5013-8927-2c646fbea37f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c9007a66-cb85-59aa-80a6-c9147ed1121f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:65d7067c-41f3-5b08-b144-2f8517aa17b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a3bdf36d-4a94-5211-84ea-5c4d1325d5d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:84b08aa6-8bd2-5e98-93b1-10bac78b7a97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:81fd417e-2b91-5fa1-add3-2c6c106cd3a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:258e8235-d23a-5c58-9dc4-d04c3a6df780", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c4fccf04-1cfe-5ce9-a23d-9625c097581a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9e755ec3-a715-5113-9dfa-73b20f83ce77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8eb4f76a-0eaa-5c9d-bed1-04e9e7274359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0950dbf1-6df2-53a5-b54b-e1d8b4e4c56d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:daa642f1-d62c-5ad2-a08b-7fe7b631391c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5e38e85b-f9e0-5ae8-9d29-c73251dfc390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1750022c-6b7b-5f7e-b36f-46595eceb489", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1b6ca8d9-7745-5503-8f9c-5edc28e357fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.30-tuxcare.11" } ] }