{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1af6b093-fa7b-5c7f-839e-db4af395ce03", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1", "version": "5.3.6-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:61a66c31-bdfe-5610-91c9-6a32b78c2812", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.6-tuxcare.1 of org.springframework:spring and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f70ee4e0-bf26-58a7-94be-96558fa10689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:0f8a9926-3845-5739-b213-d477cb6d84a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:560e3119-b711-559c-804c-7f6546445303", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:331e9a0d-ccc3-5c8b-9543-ada14ea231dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f4a20209-3b85-5f10-ad94-d2981865441c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:2eabd00b-923c-5736-8653-991fc74f4863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:673e269b-1c59-549b-a09e-2a8b7cd4e7b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:73bcdfb7-c744-511b-972c-79a82a087702", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:88a82ead-b60e-5535-aeaa-77a52b6bbfcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:7fe92984-4c5b-51b6-9dda-1253b2888a51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:92a186d4-55a4-5a07-b601-9babc3992ecd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:76496214-b838-5d5b-8ae3-1b376b9878e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:a3e5200f-40d3-5aa3-a1e5-bbddc852e43b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:895528a4-c09b-5565-953c-2261329cc5fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:832aabfd-fa48-5e62-a66a-88cf4a1ef6c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:03702ee5-eb6f-590e-a733-a65ab4abfea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:3135939d-21be-50c1-83f7-7c5aa451a2c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:dcfacf6f-732e-53c1-b3b4-20db259a46ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:c34251c3-c220-5e73-8474-61259cc13ec8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.6-tuxcare.1 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.6 is not affected by CVE-2024-38820. The vulnerability concerns locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, which was introduced by the CVE-2022-22968 fix in version 5.3.7. Version 5.3.6 predates this fix and performs case-sensitive field name matching only, without any toLowerCase() calls in the affected code paths.", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:90937950-1ead-5eec-a051-142c6c817365", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:974da0a3-9de1-5543-a57e-7bcb31dd746a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:67cd8fd9-4b85-53ba-9165-6b901a09927e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:00806b8d-ac0e-5615-9228-62ed62330f6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:a258fd6d-5b73-5945-8640-0f74d761c83d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:ba4d88eb-2890-56c6-8cbb-0d07d2c77075", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:dea2d833-d711-5deb-8d38-cb4fc11b291f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:b64a5f4e-871d-57c6-aef8-9a501331a8a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f523a1de-a11f-5db8-afca-49860036004c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:13d9714f-d9b7-549a-a566-25da5323027e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:00bf430a-3642-576a-a464-6a37bd0f6383", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:230e8a40-dbd9-50d3-b2cb-4fdd6f26f0d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:52d293ee-61f1-5be0-9c45-78b0cc20c7c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:7aca8e93-0d88-5ed4-8cb5-96151fa32708", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:355a9ddd-8c29-5d28-a42c-3c1c98005696", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:34ae5d7b-a045-578d-bdbd-857cb80b93a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:fcbdd299-44ad-5821-a0db-04aa66a9e680", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:d1476178-edf2-50db-a14e-9d19011de220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:b10ddc59-99d4-59cc-94e2-e2b9cdba4af6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f82ee312-5b7e-5266-bb3b-037d7fdd8a3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:6827d84d-e113-5da6-9a00-38ca7e87134f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:87ff5793-ed68-5e33-90af-6ef25d65d8ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:a4d5bb87-73e9-5272-8039-d34b6bed2a60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:98eae885-450d-5760-b12e-b23faec9380b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f3847e71-6875-514f-bf74-d531bdd2ddbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:74c929eb-40e9-5677-9d05-ac815a408f83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:11c78cf5-7c54-5f57-bbc2-6cd7be3744d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:d286eaa7-8169-5423-94d2-ebf2a6fbd6b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:4dd0c2e4-6b73-5e7c-862b-2f69cec2aafc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:72fbb333-fe6d-55db-9ddc-c67b94c9d4f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:928b18b9-eb4b-5036-8dbe-966c94022bf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:4942840f-f642-526a-ac59-1b73068867ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:3386b906-0c5e-592e-8339-fad60f4729a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:9a3dd165-44f2-5907-9269-03be43efff83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:1d239ac6-0f7d-5d4a-bc2d-9278beb1f3f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:38af7ba9-a71c-5221-86d4-d122dccaaa6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f13a383e-155e-54b5-b1b6-5c4c80a74606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:eb8e7d3a-edcc-5b65-8ea0-10a859a66a43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:19c58dd1-4494-5a6b-8728-561eecf264fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:8f0da110-da19-54f1-a397-9a77376da5a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:188abd63-3de5-549b-a158-990a9dc14b96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.6-tuxcare.1 of org.springframework:spring." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.6-tuxcare.1" } ] }