{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c8a7a38-52e7-59a9-9035-a6d0b952d6b7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:708b74bf-b59c-5ed6-a95a-466e72a9fdb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8afb1d02-5d08-51a2-87f7-466eaed132db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:57ebf3dc-8756-5eb2-bb4a-04a332e16c01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2ea560fc-c996-5d20-ad2a-fc3576caa5e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1c9e643b-7164-5f4d-a907-2da0709745d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8a48732f-9f37-54cc-9702-c67535efa40f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f7f07cdf-49b8-5fe7-82e8-460998f80341", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:370a9a28-7d0c-5d11-84c4-898d6f3f3b4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c77abb1c-357d-5a0c-ab65-4c5e04122ce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0e3d7021-28c9-5479-af31-ae85bd736d53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a67d5fa1-ce91-5e77-a300-e7a6658e3f77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0758fefe-05b5-511a-9e03-4b4473a6fe80", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-web 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:da69eff0-62bb-51ab-bea7-c8613cf0f178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c456dfc7-e58b-5571-883c-9eb34488fbc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:414bab27-48f4-560e-b431-5f7afbb9fef5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:26e0856a-ea2c-5ead-9ede-dc415176003a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4c7cf6ff-9bbd-5709-827a-af0a055102a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:185b0acb-87ad-5321-a954-97c941c07460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:81b2c183-584d-5c39-9646-a4a2f797db3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1107de96-ca0a-505e-b6b6-61f4cacb9623", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b43b6502-48f4-598a-aecd-be2ea2957006", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2f3dc6c1-0db6-57bf-a7d0-a53715e48523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3c5d606e-eb96-5f13-826a-a728ecb2c957", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:869f7d55-c0cb-5d84-9531-ce5b426862b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8350d18b-c429-5e3c-ac73-3935d52e40e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2b51690b-c11f-53d6-ab12-f9c51484326b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:be8a9fd2-cec8-5009-92dc-77a6c77a67c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:284d4f50-e1cf-5f7f-a1c8-ae9c96da1224", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bb4f25ec-e682-53ff-8437-745964a035d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a56ce848-6a92-5aae-9619-0acf958e4b70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e151cd9e-23b7-51e7-abd8-ce36786e313e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:536ac283-a4b8-5da3-89dd-a1c378267793", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:faa95c41-0d5d-5b0e-839e-d7f558eae604", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8b63b755-7617-50ac-a359-a2be85854e18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:52e7e66a-647c-52c5-a038-8d2f788e7a55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:352a23bc-4a03-51b1-8a1a-63f426fffb78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:570f942d-4543-5c70-a97d-5d9808f6c8c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:79ea584f-a4fd-5c90-a723-0aec91c6010f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e6aa3d83-ddc8-5c78-a888-f8dba7f5c229", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:be79ba3d-14cd-5be2-8f16-035dab196237", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b593ab04-95ff-5dcc-9a2d-544081f31258", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1c2027fb-7f66-5d51-bfb9-235eb7866517", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f0935d3b-3c2a-536e-a6e8-d4ee414917e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c494394a-5bdb-5f0f-9c68-f4203d4d9fd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:30cffb56-2da7-588f-962e-183284d28224", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bd73f29f-7bae-51cb-8e77-06aec50eec46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3849da06-ce58-5f19-b6a0-0419626dd8ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e9539932-aa66-5b55-881f-4617dc74104b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f9771bcc-7168-53c9-af02-fe9cc1ff6c71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0cdaecac-b0c8-527f-ac1a-8df63542bcfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f2577442-c354-51b8-a3a9-386a8642c574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.29-tuxcare.11" } ] }