{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ce41effb-4c43-5875-b72a-f41b0e8451f5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "5.3.39-tuxcare.15", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a9ac731f-10de-5806-8200-3057e96069e1", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:138f714b-9374-5e58-a780-88b990dc9f4c", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-oxm. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:5f6f0cb1-8824-5f0b-812d-b5e7c3197a34", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ff2aad09-77a7-5d2e-84b0-cf73264f9343", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:3285b05d-aabb-50bc-8839-806eb00700eb", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:837fc6e9-a474-56c3-ae8d-1ef4bc8773a5", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:aa54f203-36a4-5ffb-9f2f-d001f67c0a5e", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:08215556-b6e1-5495-82b7-b43835caddf6", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-oxm 5.3.39-tuxcare.15." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:9f0004bf-3ec8-5c6e-adb6-b984f239c857", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:0c8b358b-5e53-5926-9ac4-0425fb6be5d3", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:2d9a45e0-eb80-5450-9a83-1c9dca95d077", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:6c4ee591-49c5-5a9a-abd2-a3add6996ac9", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:8e5316a6-76c2-5d4e-b140-a45129d79e2f", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:bffdee17-ecf4-531c-bab1-6ed32b66fa55", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:bff37dc7-3c4c-5336-b911-61d3272ab5a9", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:63170189-8af9-5931-81c9-decc53f5f609", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:6c79d919-632a-51f8-8a55-02310161d0e6", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:52178320-2b52-5a93-b403-8592cf31af8c", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:0df02ad5-f709-5c33-88a3-7681b67c8959", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-oxm. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:0954bfc2-5a33-51b7-ae51-d7197e15b0e5", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:02a72cfa-11fe-578a-ba8c-c208e0715529", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:72e85b1c-19c3-5fd3-9058-064178d13845", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c6d84ba3-7ee4-5157-adf1-179366b704e9", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:3c3d2554-663a-5e7a-81cb-e8def960af17", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:5bc9246e-fc4e-5dbd-9072-d18469390295", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:aefa1836-fb75-5f51-89bc-6c22e12d5492", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:9016490d-460d-5953-96be-7745993f1c56", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c920609d-0a39-5222-8091-7d3b9351dd42", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:68a12c9f-82d3-52af-8e8d-eadcb9e700f3", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:7de07aa2-531d-55be-840f-8cbf772cf602", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:56edf5be-8620-5be2-b2df-d55e047346f0", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:57e67314-dbc4-5b38-bc4d-26d0d1616d78", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:fa3684d1-caae-565d-99df-93a1bb2a29c3", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.39-tuxcare.15 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.39-tuxcare.15" } ] }