{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ffb7319b-a07a-5be8-aae6-2ce59810606c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:081ed82d-ecb2-5b86-8fb3-b52f308b4d8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e1eef3d8-1284-506b-95d0-dd14a24f962e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0a4fab61-fb70-5c64-a9b3-0366c86c2c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ad8e9911-64f5-5326-a11b-d3f9dd5c1aa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1eaea95b-671f-5098-adee-a5d409dc7fe1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4090659d-274f-5a43-a279-6451071032c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b6478877-e0d0-50dd-970d-7e8cf359e26d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0085903a-a959-5705-a924-36743788f79e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:27b2f7c2-4007-5d1b-b8f1-5d0e60317bd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0187c10e-ac87-5d83-befc-a86dc8e26803", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ca0721a3-1cc3-568e-a9fd-4b22a5d08b58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3bd4ed65-1b3f-5bd4-9035-31f27ff1e104", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jdbc 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e2389e0b-1f09-566d-b9db-b05f5911b5e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:424cb1ac-d0e3-50ee-93bf-128431a80d6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:19759697-a097-5eb9-8b07-d829570270a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:23377571-9265-5a7b-bc1b-fe544fc0ac1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:48c7e8e6-695d-5d1f-8603-061cd924bf24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0b15b3ea-6729-5cfa-9f10-69f5bcaabbaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1c1037e2-35c4-5d8d-8d18-eb236890006b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b5821954-a814-5414-bb6d-352d2b2cb454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ccdf2cf9-d8fe-50f8-9cb6-46009b6a1eb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6238ae1b-36e8-5a14-b194-78d8b70b8f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0ab817a7-f9b9-5bef-9634-0c40b1cc5f5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:499f626d-c5e7-5099-b676-1616b797edc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a7e96937-0641-583b-a74f-a79311878736", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e0cc74f4-05f2-562c-8e0b-d2938b1da96e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:07b6cde3-1d98-56a8-8728-38ac416b984b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cf74ff73-6dee-594b-a20e-7e0f2bb96699", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f486e8a5-3e43-5ba6-a03d-207529d75d86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9ff7b693-7e0c-50c0-bf89-f8823fde1bca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:77b70ccb-7edb-5f5f-aba3-b2c4033332f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1a825aec-2a14-55e0-9245-bc74a5fb4fef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ab6e83b1-5733-5794-ad56-3eb58a0a206d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:131334dd-b89b-554a-85e4-cf5f660bcedc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c8382f71-942e-5d59-a9ab-98d9be2e14c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c3cf2fea-0b18-5522-b777-dab0edff39b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b9deb60f-e3b5-5272-a825-8e43eaa95734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cab79905-d10a-5632-9970-51a0b94047f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ce9ba806-7755-536d-9ba3-de2aa075da6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:14a99ea8-c1b6-5aa7-b87d-eaa498fadbfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5df569d5-cee1-5582-ba70-bfa52d086ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7ae4925f-2bad-5d16-8f89-284505ab4aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:16ffe8ab-f514-588b-83fa-3236f91da923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9aaa4d85-457f-5e18-94cf-31d4d2d98e4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5e38014e-1ab0-51c9-8b53-f77134cab007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7a440495-4483-56dd-9e05-9530b54f102f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a50d4244-9343-5001-bdb9-e49a33c56e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bb6410b9-01e3-5279-87ba-14588876716a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:702923db-5944-5220-a24f-a306900baae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:355bd362-78a9-55eb-94b3-7b948ac4c4da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7222113c-49d3-521d-a01f-67d8a67d3a45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ] }