{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:abc47441-d117-5894-8cbf-d140ca9a5e19", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "5.3.39-tuxcare.15", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2206b25f-84a7-5790-8cc4-7704a58d9f69", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:beaf0568-0880-5195-8a18-e87584cbb4d2", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-context-support. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c044fd59-9f56-57a2-a9e2-69f5770dd342", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:862eb495-7720-53a5-a668-9973f01757c9", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:b3c23347-b5c0-57bb-9091-ab9036e1b750", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:f77426e4-7c9b-5908-8fed-ad066d01ff31", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:e72e8ec1-21d4-5d3c-9ab2-8662e0143987", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4f7afbc7-8606-5828-b6fd-1020388459f9", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-context-support 5.3.39-tuxcare.15." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:0c1cf615-ba76-5855-b114-a36339eb134a", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:691bc492-4e25-594c-98a6-b725079bd356", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4412d3e1-bfda-57f0-aebd-6c630cf632c7", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:8208fcad-bda1-5ca5-b693-bcd0d571e54b", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:edd8ff53-304f-5a09-a6a4-72833e0ef9a8", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c1e0d11c-edc9-5976-9450-87305f8a99a3", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:1763ab59-19b6-5eb0-9d57-63ca6ab077c7", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:fa084803-1718-550f-85df-b2e6af4aed2b", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ed0964ec-5853-5aea-a19e-c154c414a601", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4103ff99-614c-52a2-bc1e-ffec2d570c14", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4ab5b030-a5e0-5529-9c25-e94cdd8d2061", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-context-support. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:99049d6f-1fe6-5f47-b014-d8f8370c4d16", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:26ff5a65-66b4-57ba-933e-3cbd4e96313f", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:e90e334d-a359-582f-92df-39d99704bcfb", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:625caab5-5b78-594e-bbd5-02bb2aebd99a", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:eb3d704b-a05d-53c9-9752-4e7c9eb87b17", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:0df5b91e-ac9f-5d0a-9971-09ce86453abc", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:44b90171-4bcb-5cc1-98ad-f62027fdfc1b", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:af0937b7-eb8d-5579-b950-0208303fcd26", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:1094529e-011a-5ca9-89b6-3c3d4d8cacfb", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:b3ea95d5-ffaa-5992-b680-4bab1777e506", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:e06ac4ca-68e2-5b61-a3bf-aa6431810fc9", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:7c8aad6f-9ec4-528a-a395-1f05a9e9a5aa", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4c2c7b24-c129-5e9e-88bf-4612a5354e82", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:45003e01-2061-56ae-8cec-49655ba49230", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.39-tuxcare.15 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.39-tuxcare.15" } ] }