{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:acf5e691-c760-53b4-9daa-476058924bcd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a1a91547-4ef0-52ae-ac5c-e1ee3e46ab4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-aop and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:85c26fe5-6b93-5e5f-b41a-58ba003b92fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a212d5e6-accf-5d66-a151-d28d75b04deb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2e467812-a902-52d0-a715-fae48da371b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b8d0b6bf-9379-5368-bd15-aa729e64f8b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:aeb7b88d-450c-5d48-8cd4-f21e3706f5de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:96c7f269-18a7-50ed-b839-12ea349bd22d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:26b292ce-2fca-579a-908a-43a58f351761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9b1c7aaf-a035-5cab-a0f0-f7453b0dce10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1fd75bcc-0b12-5ac1-a8b3-4f3b83dcc0cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f0ce9a01-c9ac-5e99-8f74-c71ad92c2a3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:424effdf-caeb-5060-9748-cbaeef5d89dc", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-aop 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:74524892-523a-5869-938d-9af57915246c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d658f383-8d31-5a5e-83a1-f211270d6a62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f044f8ad-45a3-5937-a322-c4b054bf80a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:659f7c9e-dd8e-575b-9cd9-e264ca9a7743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2da5690f-031b-53e2-9222-bac4af261beb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:73dad4bd-5aad-535a-b59b-9601304eb49f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:51617d01-d8ef-53bd-ac3c-bd734e2fe4e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:64e322cf-ffca-5cbd-9f9f-c5f03df72a6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:49af6323-2b71-5c81-9f37-e7f23977df51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:dcd94248-8253-5314-a4e2-b55eceb9bedd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cabd0e22-a0e2-5788-8559-d9042bcc2735", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-aop. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d0131e1b-f7c4-55f8-9a56-96487359a357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:148f0c5d-fef8-570b-9b54-36ec735ecec4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1339ddd2-440f-5290-b266-bf4333ea7325", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1ddd31b5-58a9-50a4-9886-119494858253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1aa67c92-c403-5173-a39b-2c5a5098a9b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2a6bb490-ee12-5c61-a37a-5cf8b6f67fcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:34cbd273-4971-5c5b-8110-49c7aa47860b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-aop. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c6e89052-dea7-5a98-a90e-6b84df8e1962", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:91f40e40-5905-5ad5-a865-34431f617c3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:235c475a-dfcc-5a54-8ebe-a42a4279a8f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1e16a61b-caba-5609-b1a9-01d8451c220a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:65204534-59c4-55a6-9c3e-595762ceb2ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5b6ddc7d-0d56-517b-9eda-a0bc795da247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1755807d-e863-514b-901e-18ef64137f90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f9bed2e9-f23b-5296-b135-a0b3a11796c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:895ffec4-5ad4-595f-95d7-313267dfafea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3c5b2b26-cf7f-537e-9f0d-f9c23eb06e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b8271867-c1ab-50f2-99df-01f2f77b21b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:15684652-5115-5856-b7d9-627f5e542e72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b34dd27e-e4e5-5fae-b8ad-0dcb6965835e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2cb227ab-41e8-5c6b-a3ba-ee00d6374727", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fc4b170f-d171-5fe9-abe1-6f4e8615f4c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7fb23f40-4dcc-50d4-a603-4a99cbca6d4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0ac94d94-99ec-5eec-b9aa-461f247416d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:efcbc340-7b7b-5fa5-b069-561c064092d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c800d584-48de-5c56-842d-f074c9eb0324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0a570ed1-1665-55e3-973c-65722d0236d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4e503f07-3692-55ec-9b34-d211ecb32ad0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.27-tuxcare.10" } ] }