{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:22fbbb75-3f00-5791-9298-503087e18382", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:80212c44-4631-52b9-99dd-2fa7eb30690e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-oxm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1fe7de14-ce32-51af-8817-2e091a27527c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:91dae697-946e-5d97-abb6-e9ef1abfca2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:60eea17c-5c8b-5e2c-99b5-82d6163d068a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:87fe8ed5-c431-5788-8298-97816d2d8900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3af05c1f-8468-53db-91ae-d2d9b887c7ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a00122c4-2b11-532c-906f-51a0936fa1b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:21369053-9d27-5fa4-8226-d78be5335fce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ffb03495-6549-5b10-8d99-b1a99da74935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cf3d91cb-6ec4-5f8d-a8b6-39b2fdb2446a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8506120a-81f1-5133-8183-fd43d8fe30d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cdeb1a94-4885-579b-8e62-521bd65b2c2e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-oxm 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ed75841f-c0bb-5603-aadc-9809b15a8548", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fa223f0e-876c-5e40-a923-e0fb11e35796", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c94c5a5e-4c2b-579d-9326-5de7be812088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9a286eae-0f6a-5f38-a191-6122a2a90586", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:62968b58-efcf-5d12-8837-632c3281a10d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a10d9107-ec01-5c0d-b50a-5839cf8329b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:39a7311d-edac-56bc-8d9c-80c6b6d6e8ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:131db4da-83df-532d-88a8-94944ff6350f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:256301b8-6518-5d9a-9fe7-3724be230e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:acc72eb0-0d0b-57a1-8c49-fb4d673fb15e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:753487dd-5ab0-561e-a04e-33a6f6597af3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e8b203c6-01d5-5cc4-8f33-7ac68c866b8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4543f375-9876-5cf7-9452-f8e9ac0e0b1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d8d9d130-3165-5f71-8893-58be3ecf44ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d6e16f1f-f647-5496-a070-fcc828e8d6e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d31ea8b2-28a0-506f-b961-5831c869e9ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c73b2c9d-7371-5ece-9e93-269127d6745d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b170354b-5083-5a05-867a-544d34636367", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-oxm. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d1cdd991-571e-551c-8887-e50f83cb9c93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:64b9f434-9a47-5e04-8577-28115336a69a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0886a72e-ab2a-57ad-9981-eec32fcf5e81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f75013d2-fc9d-59be-a919-707e60ce35be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0b7a7a31-1bf5-54da-b1c4-0b202ef1f0d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b68c683d-56c4-5813-9947-d95b57bba456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:dc6de257-dcd5-5346-aa70-64f5a0810223", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c0bfe12b-a932-5178-9150-44a953a9c8d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:078d73b6-83a5-5723-b26d-fb902f0354e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f2df6261-84de-5044-8b32-dba092f22547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3b5b2e11-91b9-586e-9126-4c50b833855c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:653f0e94-12e8-535f-b924-757cab518825", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4daff19e-cb4f-552c-87a4-e51c95ca53cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1f86d9a3-fc80-53f2-9061-a5193b35cdf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9ccf6a6a-f689-5922-b084-f5625ae9a4b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ca229f00-170a-56fc-8eda-635427c7a0d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c5fa995b-6215-5f5c-8a8a-28913ff0d154", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:702da48f-a611-5e4d-8c40-fe7f9a445032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:11b552fd-08c7-5817-b2e7-dde124a72490", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:85c8a00d-7337-5380-b6e7-e1080016dd87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c5bd51d7-81ec-5ce3-b56b-e81b9184aa49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.27-tuxcare.10" } ] }