{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2dfa178a-6c12-531f-8792-488b18186492", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:125f5517-651c-54a9-abfe-0dbbc608c6a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jcl and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7805f602-aaea-5ac0-ba2e-c1882cefde23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:63a01e6f-f94b-5884-b389-78bc289748c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3f808d98-abf8-53ec-ab8d-27a66fec861c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e423fcf1-3a55-54b3-9807-736af0f0b623", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e3007018-98fa-5462-9b29-59c9802722d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5d0f2bf5-bd14-57f2-b7a7-aec0f6f59bdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2e722737-8baf-54bb-a4ab-3e17c3477132", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2b9b39de-9b50-5c4c-a69a-ee1b4abd2e70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0ec6bac5-735e-5314-a247-5c2701ecf98c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4b9fe635-92c2-52db-9649-25287ec121a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a180b5f9-103e-5902-a157-6a1cba422b86", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jcl 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1e18e69c-ec96-572e-a8ea-d1818f3dc67a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae162877-85c7-59a8-b9e4-5b7d278f9f6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae2f6e70-0cbf-53a2-8fa4-a7d1883df9e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1741bbc5-e344-5aa3-b808-4c2bdd6ee1f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8e1d3271-6101-56df-b5d2-fc231b180f81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6b7e9f57-74bb-5db9-92c1-3c1f4570157a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3e1d7888-fd01-51eb-b072-ca40a42ec36f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a95f8a7b-7264-52ee-b065-6a6ef0da103b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f26108d8-3a5b-5783-9b5c-b239e1ba1c37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:068d033f-d613-562f-91c3-41b5d8a01391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e30f4b98-d5d4-560a-9cf4-d8f1e46fae0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jcl. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5dea54e6-b63e-58a8-9f66-818c72c3ffa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e199fcd4-6b51-57a0-9b13-62760c55eb8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a5637790-9d76-5490-abf8-62095103770a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1f8fabc9-a451-504a-aa36-4fb48715b52f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:abdbf1b5-4863-5e6c-9c5a-3100bae2d595", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5c2365ff-ac5e-5abd-9704-199ec4776152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d07514a8-28dc-5066-9431-32f8fefe893c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:95c43e7f-65d1-555f-b515-0096dd04ad91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f3e0b09e-e364-5f12-9add-9ea2bf5fe24d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6bb0831b-0f0a-5494-8535-9faaf4067043", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d88302aa-703e-51ca-bf0b-05837f034200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2aa42c26-37f4-5b78-9da8-85f37f2a7f55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:78ed845d-f4b8-5c09-84c3-7b4fd9aa5cdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a46f22f0-bf9c-591d-a1f8-3bed39a2e0e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6756f0d1-ebe8-555b-8d41-ec19eef65cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:23376f4d-4f2f-5e0c-9d69-d25515cddf91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9db600fd-d438-56ed-b6d6-d252003aeecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:12f8caea-e7fd-50db-9d72-2d2938d10678", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5e596525-16d3-53d6-8355-cbf252b4c8a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6f28f8f6-4f3b-538b-9132-650083b9a56c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e303bb49-7b01-55e7-9eb7-be764ea24c3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2e948664-c807-5495-8ba5-6df8a21bfa30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e303dd5c-d525-5be0-b4de-de45a94baf25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8204e877-590a-59d8-9d71-5780b46c4dc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4d02fbf3-93b3-58e3-a95a-b30ad2a516a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b8719797-2965-5e06-acc4-a067d296307c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7ab053f2-25cd-5bd7-bb27-dde3c07fea9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:004ef3bd-23b5-5a53-a722-2d484327f2b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.29-tuxcare.11" } ] }