{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:398e473b-fd42-5d77-8273-562f5220dc2f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1", "version": "4.3.27.RELEASE-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:80c06a64-6f69-5fb2-ac47-ffa29e97a193", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6c6a5ef0-01be-5d63-8ea8-8b510ee19d29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e80fb460-4bcf-58f6-b41f-b72a6ed29ff8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:324711a4-0448-537c-a528-cf96422260df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm. Spring Framework 4.3.27.RELEASE is not affected by CVE-2021-22118. The vulnerability exists in WebFlux's reactive multipart handlers (SynchronossPartHttpMessageReader, DefaultPartHttpMessageReader) that use fixed predictable temp directories. Version 4.3.27 predates WebFlux (introduced in Spring 5.0) and uses servlet-based multipart handling via Apache Commons FileUpload with servlet-container-managed directories and random temp file names, eliminating the attack vector.", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fdd3217a-d2c7-547e-9705-53f19d552d7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e023e60-195e-5f0f-8f57-3f372d3bc8da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7bb14b0-676b-505b-a2b7-72685abe74d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c2eb5055-74d3-5ef1-9acf-e7b35d025f0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb99223c-c341-58a1-90f9-5740b7032aa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6b7024bc-fe7b-5f2d-a48d-b8646fa30158", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:303c12d0-8c5c-513c-ae40-66916a0dd5a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:018b92a4-5a96-53bb-9b53-181b1fb65191", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33d3b297-9187-5960-a8eb-09fe246eed41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a35bcb4d-9524-5287-b14c-16edc2c9c1a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b310cf91-33b4-53a9-8eb2-b5ee27c45305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:90119b5f-0e17-5145-8211-ad08fd3c2acd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fccaadec-87e4-5fa9-b60b-f3cae81820c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e55c693-a4e0-5b0e-b76d-611cf3beae2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 CVE-2024-38820 describes a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields pattern matching, introduced by the fix for CVE-2022-22968. Spring Framework 4.3.27.RELEASE is NOT affected because CVE-2022-22968 was never applied to this version. The DataBinder code uses case-SENSITIVE matching without any toLowerCase() calls, so the vulnerable pattern described in the C...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5c1c3854-dbce-5056-bc62-179afba27305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d67a2769-e6f2-5126-b367-e31c721c32a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d2d6700b-17c8-5522-aaf4-cb1c08f3bea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:be4381d8-6417-51ea-9eb3-81590abbb7b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:021662b4-d46e-5e79-bb55-bc4392b0d223", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bc7c225f-1a80-52b5-89cb-9b562a287b88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:13390719-fcc3-5e79-a89e-50212e331188", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling components (PartGenerator, MultipartHttpMessageReader) that were introduced in Spring Framework 5.0. Version 4.3.27.RELEASE predates WebFlux entirely and uses traditional servlet-based multipart handling with a different cleanup mechanism (finally block in Disp...", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f8e38f9d-5964-50af-8725-7fc497876358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3eb8fc6f-63c7-5917-b9da-d732186fd4da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3ffa38f5-755c-5c8f-847b-fb915c0c8aa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:edad9695-154c-5bb2-8dd0-c0824f4d5cbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:554cbf03-3ffe-5ed8-b758-3d78595b13ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e7304ffc-4931-5607-a33e-f57817491ca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:215ab558-6081-55fb-af2a-6c02ce9922d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f576e320-6967-50b4-aff3-36b4cc415291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4aa54bb9-9c76-58c1-82f5-49756c6b60a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4063acc8-c530-5f7f-b0c6-83d81dd66c60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:86e8994d-db8a-57f3-8a0d-058bafe4c6b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3d257b9a-74a8-58d6-b868-0607cdc2861c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c0b68f06-a8bb-5619-ac13-daef3827685e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3fdbc174-308f-5f5b-ab53-cee92daaf6e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:af1a4c95-242e-5071-b40d-fdc40f6baebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bccacad0-9f29-50bb-914c-1d589df11361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:257e974c-7a07-5423-9c8a-e510e63f42b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b4128e91-7ab2-5df9-b75b-e34e284b2e5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:37020fd8-9550-5ba2-b516-d0650e50dd53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0b04c839-a2cd-532c-8267-bb888976a3f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:04b8567d-542d-5a6c-9b65-302674e4aa77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0e7722d-4065-5ddd-ba67-98d8eed70302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dddaff80-504c-54f4-a2b3-fb5548a4b980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dfdc44a5-b587-57aa-a898-14e7053b97f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8e0ab51-f0b0-590c-b038-c61b960d6549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1" } ] }