{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ebec4988-97f4-5746-928c-b5be8445044c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7a37f9c0-e9e5-5e84-88fe-974a6993a954", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jcl and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4247a985-776e-51a6-b195-9752a23a4397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:49631c5d-8935-5338-84b1-0811f93c6ad6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9bfb7b50-9570-5109-a270-ab3e3108a85e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3d475f79-fe93-5f0f-bb83-ab5be2ec7d2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ab8386f8-00ce-5f19-bffe-3a2783e2bc9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:86406bca-4704-51ba-886f-6e5e57df4373", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:40cf3513-9f8a-545e-8796-6c89a93922b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3db19a09-91fc-548b-b286-5b60add9f378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:12aec665-4ef9-5a14-9f1a-b9e5e5d2084b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:af1b74bb-30aa-51e6-8ad5-34a4da4f4bc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fcdee148-6ac3-57e3-bbad-76d52a263f5b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jcl 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f47b0cb0-2f03-524d-b319-68e127b90e86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4f22a02d-a348-505c-943e-bc926c113611", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a42c4e5a-397d-57cb-82b9-aff11a3d467e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f2898853-497a-5835-be1e-67b83611c494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a11896f9-4713-5a08-9dbf-a8befe9f256c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1240c324-c63e-5f90-9fa0-17065254a83e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:775bf1ea-c93f-5927-a752-38e99b0a6164", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7fc7334d-9e09-5858-8fef-ed8dd5912f88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ef9d987f-7acb-59c7-8f70-26478e0878c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ca2fc1c8-64c9-58e0-9988-cde6296ff6c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7907e43e-6fe8-56e5-a8c4-a634531b58e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-jcl. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3e387cca-fbd0-5421-8e31-2b13fc7a5f10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bb9f284f-c039-5cb4-a752-b032ae952cb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fe377f68-07d2-575e-a74d-0b68d112c0e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:747faa2e-5c34-578a-afec-6a6b985ef315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7f7e2832-f5af-5f32-a5a4-1ba38bf80732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9ce06c96-994a-5760-995b-7784e91f05e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:107cb575-9498-57ed-9417-27f6e06b7bc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-jcl. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c530ecaa-6535-51d0-8af0-1fbad44a1129", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8d8393a4-650d-57c1-9357-2673eceaaa87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d2c50d9a-94fa-5890-b746-1476112fe5f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b0043f1b-9247-5504-bee3-045718725b24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:64be9a7b-0a91-5e10-b04e-4c629f85d163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eb12211a-3338-5222-83e8-aa36facc97d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:899e8833-9108-5c97-a341-40bce66828a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c369c27f-c1f0-5b7f-a166-5bd3f8f0eb2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ee977b83-a43c-53f0-8070-292fc5fe2873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b91c57ec-1712-55eb-b903-0ed2ff89a346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4843a2b9-b786-5b31-b68e-40939a04e28e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7dbb0433-61b3-582a-a742-7f5a7607279c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:42cc364a-3b5f-5f39-aec8-a3d774203b7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:38f7bbd2-2100-540b-bdbb-96ab8e9e2f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d03a9e5f-3038-5c8c-8685-0a9dc0754fd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:35455310-9251-5bbb-878e-38c157918577", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7e788b22-9e76-5adc-ab6a-be71bea2444a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:75de1ed6-2904-5355-8040-03e0ac7fd7c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:af5f346a-382e-54d0-a4fc-da1f745632d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ea17cc1f-8734-5cd4-bf30-c1bbccadf93c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e6d61072-920a-5f2a-a842-9113ea6ba949", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.27-tuxcare.10" } ] }