{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7c26f191-95d3-5a65-a6d1-0075af4e54b1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9", "version": "5.3.24-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5f0f46e2-90f2-55ff-aeab-eac2fd0efc5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.9 of org.springframework:spring-jcl and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:990448a6-5d88-53e4-b92c-27f0a5317c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d59ae61f-21a8-5217-a09b-bfc64cf90eb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:295fb15e-fd99-52ca-915d-f29ded7141d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f371f7e3-e0c6-55e6-b293-9a60c06863de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:68781c1d-de95-565f-9dc8-9193d15670c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fa046a63-9895-5a6a-87e2-781921f400b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2f9498ee-d86b-5258-aee6-a12a1c0b151b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2050a5b0-3e15-5d33-a849-e88e739f7cd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:525d95f4-df07-5bc6-9cb6-b16524b92f48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d0957442-7202-50bb-bb49-250f398801e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:3cc82f30-e70c-5061-8a55-fc195188e538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8c9cabc1-8a65-5ead-9799-af3c3692be95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:0a35e466-e910-55e3-b9c3-326cc7ddc9d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:536e764d-6b84-5373-acbc-da0b654953e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:993a164d-9cae-525e-a015-f243be10e838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:61c4f61b-4c23-55f8-866c-cc5016e11e03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:01f769f0-80b4-53a4-afd5-af702b525f57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fdd0f5df-302e-5205-93fe-5f4a3325ae21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c80b00b7-1b69-5d04-9b2b-d72ff7353b4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:85d48a68-8713-5229-9258-c8a754e57383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c0a04e0b-fc53-5f88-b9fe-b981a4f06854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d36b1024-fca6-5ac8-8e92-6d4452de4be2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:52c29c20-118e-568e-a92f-7fd545222923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f2f2c3f4-377c-5e4c-9c8e-9df7233dc1fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-jcl. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6a894ae5-e383-5fb6-b8bf-584667bfab5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a681d19b-d4e4-5170-87aa-692bb0b026ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:313fb3c2-d416-54f5-948b-a163f11fafb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:cb23a521-4b5e-5a0a-9766-cc1b3c754f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fcea7e21-16bf-581c-90f7-9f3b3bb71a73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:0aa3315b-5e7d-5a89-a6de-f70d7b4fd29d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:71eecad2-dc5a-5201-a347-53bc28f30095", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b7ab9033-0623-5fb3-862a-90ce5b73980d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f356124b-6e19-5836-8b60-060c00e3b35d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:4f5b8ddb-db67-5629-80d4-ce4defa0c11e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:9c6d331a-cfd9-55fc-bde2-07dd7bd6b628", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:17117cf5-cf97-5571-8e0d-5decba0ab1d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:50b18152-709b-56d4-80c6-f4a6cc5e3ce7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:aaa3f1da-349f-5e09-8dbc-952448b40a8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6a133b10-d88e-5d89-a52f-04340d606c54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c79b6a3d-fdbe-519e-beed-eabc7c0483e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:0a4a0059-9e13-5617-8854-8326ec3f92d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:27439d36-9ffb-5947-ab0c-0929c8546f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5b058aa2-c706-5745-b11a-e59303d3f3be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e8de636f-24e3-58b8-8a24-602ded198018", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:95159fbd-da56-545f-9571-58a64ac0be86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8f20dfab-d186-52d9-9b16-8e3cf2694b46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ec0dbe7b-cdb7-58f8-b98e-0763459e51ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fdb20fff-fd5c-51b0-be4a-019672f39198", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ba6b4205-60f2-574d-b01b-b09cd072fb36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:9be84cc6-eaac-5dc4-828a-51ea03731e7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ea907acf-2b13-5bd9-bdf9-32859f75c3e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8e43386f-1d36-510f-96d3-828923a186d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.24-tuxcare.9" } ] }