{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1a7542bf-319a-5096-892b-34bf7fd681ea", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13", "type": "library", "group": "org.springframework", "name": "spring", "version": "5.3.31-tuxcare.13", "purl": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:aecb09a3-2565-51d6-bcdc-676d0588353b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:5a4f7524-3123-5ea6-8c2f-2815f8e37ee4", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:b09fdf5f-173a-56e4-8363-a9e04b6676a4", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:67e07cda-03bf-5ebb-a2ec-ccb91ef39260", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:6013bd87-bf67-511d-814a-2522b3b49030", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2ecfcdb1-bf72-57ba-ada4-9541af55ad69", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:4b3c2983-6b08-5ff9-a8f9-ec800c0bdb46", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:1c304756-4954-53dc-9e5b-37b24c2e0976", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:1adf0efe-e5a9-5f41-98b8-bcf469d57c4b", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:66719aab-b4fd-51aa-9600-0152c1d03654", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:63348f9a-d4f5-5cfa-8f08-52db11b3b867", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2e3603ff-a4cd-5b8f-b387-5c8c1b026c24", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.31-tuxcare.13." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:bd1a94e5-aa95-5c54-b03c-d2d2949fab0a", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:16452b60-cad6-5fba-b739-f6dd6e56ea49", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:5677dd52-19ea-50ed-8e70-94508dc8cedc", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:d6d8a845-d004-586d-afec-5f47ab7ba3fd", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:9a0411a1-2569-537c-96b7-c9f8592db925", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:123daf67-5801-511a-817c-4e985fcaebb8", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:8816b680-aa1b-5d0c-9a28-0d4c66538ed0", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:9cea5494-639b-5890-983e-0fbd4f2a3878", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:ce8c44db-8292-587c-8899-e422ca553ed8", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:3dbd7d47-db15-5235-8a7e-7ec336dbe485", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:46acf1ba-45fc-56ab-bc0d-944dd7813b79", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.13 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:bfd7b877-437a-5aa3-bc1e-b4d6d3b6ba58", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:616cdb7a-7c02-58c1-af15-5612438164da", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:78e4ebf7-30e7-57d9-b84d-1bb65051f000", "id": "CVE-2026-41843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:adc85613-6a26-5a23-827b-8a4c289ecb56", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:4231933f-efb5-5bad-b484-3c55b2c49a47", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:4ce56275-5c77-5cec-9ba1-bc943efdba7e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:ebd29dfa-9aa1-5705-9ccd-9638269ee3db", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2e135576-6ba5-5542-84b0-ac78fb5885bc", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:fadb35f9-9c0a-59ae-a907-5e173848c961", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2b71af92-44b4-5c59-be7c-fe417e77b428", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:e0fc58e1-09dc-5aed-87dd-9b0c18848101", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:524ff2c7-452f-54ca-8cce-0824834304ef", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:08f3e694-34b9-5fe3-8382-7300992ce879", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:c3feb0e3-f8a5-54bb-acaf-3c2f9d7e30fe", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:26cd8bf3-750c-5819-bbf7-f6b48d8c7066", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:126823a2-8a16-5dba-9a21-949c5cdf8653", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:5a3676ff-edbb-5236-9021-bf7678cd8bb1", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:f8078b86-f749-5a6f-8acc-8875d00bea7a", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:385cc8e3-c563-536d-bd53-936356f75aca", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:de37ff8b-c8b4-515f-84b1-713e099cc884", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:732f14ea-c808-5ad4-99dc-b1eedc392a2f", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:a8804144-57aa-58ee-b63e-b5909fdc1e53", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:de68279e-c76d-517a-b339-ab39ecd15ae9", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:b5cf82d6-9250-5ecd-a734-f03dc0e763c1", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:355cd365-fae7-59a8-bdd6-c40e18e0fad3", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:efa1e9d2-9ca1-556d-bd1e-6961d3e9ad91", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:ba731e57-2239-50da-b51a-e3e0c2db012a", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:60447ab4-b93a-50ac-a515-41b2a958b945", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.13 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.13" } ] }