{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1f068c28-1e06-53fb-8335-6f9ab6e5099f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:69557933-4cec-569a-b885-906763f649e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d589212a-ac57-5b5c-b734-2a81be16051b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fffbf552-5ffe-56c3-a285-d4523e43f596", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c3826435-a4f5-50af-be82-da8643bdd8e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9eb35e93-cfb5-5a21-bbe8-ab5d21d11e41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d36f604d-73c1-50cd-9d06-d3473be50f02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:23eeaba9-e79e-5074-9094-0751424cc331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4cd00368-2dc9-510a-b982-4f5092cdea41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1f3b14e2-d07e-5e64-8bcb-f9bdc51d5936", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:df9dab26-7d25-5476-a1b1-57397a171522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1e5a6264-aef3-5987-ae72-2668685eb75b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2e3e6247-a3f4-5f1d-8937-6d599743015e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-oxm 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2dd6de57-b295-575a-96f2-69648f1a0269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae4ac39d-ed26-5401-b8c3-145072379294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e6e66fbf-ff63-5ea8-9627-7259255a4885", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:320ed5c6-0eb6-5932-987b-e22e78b1aaf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d3cd9d10-6329-506e-bc5f-3d8c6a676fba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:108d8153-ab9e-537e-8824-4a5f2432eda7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:85279cf8-8437-5182-876e-cadf0e32b1f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5b7fd9fc-d37a-594a-a09c-94cf0e9ea4d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c509b2e6-9d9b-5f48-9f58-dc2638490995", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cd7ac621-693a-58c7-bd13-da50db980b90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bd05a2d1-8cdc-59dc-8632-977b88b248a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:465da242-09e8-598c-bb46-007e6eac0218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9baa6d29-cd6e-5794-8700-d0cf0c666fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a9b2f7b3-52bb-5f25-b146-6c37755afb7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:76dbd362-0e5f-5a0d-9cc0-c263876fa374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f6490767-5f46-5f05-a6cf-3f3eb213b2fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:80cf566b-6634-548f-aeeb-e700fbcd101b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9872f8ad-285c-5329-a41b-fc0131f85558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fbdf0ec0-b765-59e3-9164-e6109cb84e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:188def4e-f805-52cf-a121-029691ea705f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1eedf968-113c-5914-926a-78d53b33efa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:484b5c67-2e63-5d3d-8bad-54fa435c7df1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:956290f1-73a1-5f25-bc21-f1e5a8b2eded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:58453983-e92e-5c83-b3e8-d935e3a2cbe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bf758214-9158-54d8-a0de-4e2779d214e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4be2e379-525c-58ad-a9d2-89305e83c130", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ced75c8a-acda-5383-9b79-5a66bb106e1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b221c944-0b3b-5a96-96ee-4674bfbe6c1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:96cde5a3-1051-5dc7-a6fc-61486de37e01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d7f74a49-8261-574f-8be9-e7ec0bec04af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d62de4f3-c5c7-566a-b732-137c67947b41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1aa2cdb8-e141-5b07-9bcf-c44ee28af258", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:369f3165-f316-5162-8265-7fdd445862ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8ad5318b-28b9-5e07-879b-0ec49861cf2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ee9f734e-42cb-5524-9506-97c5552733ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:983c9419-1fea-582a-beb4-9bedf5e24b7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:52c08dde-82f3-5159-a370-556ce40580b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e59560cf-d16a-5da5-8d2e-1f9a870f6a47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:284e57e8-9157-5aea-8e20-a5c55d43891b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11" } ] }