{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:34d808a7-3a90-5fe0-b47b-4dde0c54133e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9147762f-201f-5bc4-8b04-f2b4d5de5e86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f454718b-002c-50b0-9fa9-23ca05a08fab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:25a4c7c2-0970-5259-b457-3641cd53043a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3028d631-3060-5720-80bc-8d11cf76ecb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1641200f-3289-5546-a4d1-2cbbcd5e3296", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d61c023d-48e1-5e15-b870-48a9842a25ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6173d1c8-4caa-5e1a-98fa-3be484d97a01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f2d33a25-4836-5274-b906-d2488951cc67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6ac0a614-dac2-5572-aa3d-a6530ad03256", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:35bc4448-4710-5a1b-bdcd-2fb35f1c70d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a17f59ef-ef2b-5bca-8fd4-4bc15ca53e28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9c51e681-2831-5b89-954c-9561a5aac5ab", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-context-indexer 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0b4c8b66-c4b6-5b03-8b4e-f64edc13cdc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a6b0efe5-8c63-5e41-88e8-f29e27f5fb6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:289be945-5810-594d-983f-9502b8fd7ca1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2e25c9d5-87e2-5b2c-bcc8-bf9c9773396e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f5f887e7-0740-5fc7-9ef9-2e272c146360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:aa89ce4d-250e-5ba8-8a22-4e18e7904bdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:98184887-becf-52d5-8675-1531ba581361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4d94250d-06f9-57c3-b008-ab1881603013", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7def8510-6fe3-5991-a301-5c9a9b65b5f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d830cef5-b7ff-509c-b29a-9c5d4984f9b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e8579e7e-f19b-58a9-b8e5-bd46dec027c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a3a30084-d919-5dfe-a4f0-70c507e581d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:14bb305e-b521-5c45-b010-0d8850e8d79e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:86f4e313-3d16-5b26-8aa9-d23463ef823e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:32a5e6e7-5d22-5c4d-92bb-fe529b01b718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5a890ea4-e191-5f52-98c0-e201b0079cbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d1efd773-0a75-532c-b2c4-dbfd2e6711a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c857a92b-4041-5fb2-8f65-d42c83515000", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5c6411b2-a236-5979-a0a8-1cabf852b98e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f1ab087a-a7b7-59a4-a386-9e0a258aeed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:149abab3-d193-5b3a-8401-708ee23e07b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:974f8b6d-269f-554b-87ad-b3f1a110d6f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:72a1aa09-50b3-51b5-8f87-ba7568dd996b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:79719a89-7d2e-5b79-80e6-8c2112b2abfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a35c8865-df72-5e4b-9302-956a6d003fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0c57429b-88f8-5a6e-abef-4853266c6b8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b394cbd4-23e0-532c-9520-817af36827b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b79b31b7-f359-585f-b44a-5022a57d396b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c9707a1b-d537-5cf0-91ea-f9275e5c4031", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:72118326-5b13-5449-8cc9-1c322ee388b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f9884ef7-1606-5a61-bc64-b612c7262f73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:772ea3a1-7afb-5eec-947a-57c837372b51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f5441f6b-ed73-5065-bd2a-8ad48fbf6f28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:437e02b4-5095-550a-ae2b-11cc87a4c8aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7a0d3826-f1e2-5e28-8795-e7622a990c92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1f058eac-e0fd-55e6-a3a5-c6197a905021", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a5daf8ee-649b-5958-af88-a70426de7ecf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9943d8ed-2019-5305-bdf6-4f785c7bbb5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b6246469-645b-571a-a095-338d1755f74c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-indexer." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.27-tuxcare.10" } ] }