{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c2abbdc-a6f8-5cef-843e-f98455e2bf90", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9", "version": "5.3.24-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d833ea19-f5fa-5249-8bcd-63695e2a3c08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:402e6934-13bd-56c9-8f1f-cd31a175e73e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:498bb9e0-3cb1-5942-86b1-7cf692372b16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:78021939-078f-5a91-bb72-a753a6d882b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e4185bcd-11c6-5d99-96d3-ea80d94d5dd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:bd9b2019-808b-5982-9dc2-9d9b379f349c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:bc6924a5-90ec-5baf-95ae-38ab5a201787", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fffba324-fb7c-5eb4-9fb0-bf799170e8f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ad98718f-92af-5826-875d-e62cae405934", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:9cdb860d-5c2c-5c1a-a98f-9d587de14b73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:45f89adb-7e3b-524e-b8f7-afda9b0de9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:3ae5c846-3d45-55f4-b478-f0c1ff02458d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e759f796-f47f-586e-9e63-7124757eff96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:66545ce5-554a-50ca-99f2-47ffd3ea1a78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2f9d413d-a8ae-50b2-a80b-6528aa7624bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2e397145-6417-562f-9ac9-a3aacaedcb91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:519bf550-0643-5e33-814e-0758350bcdc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6538e41c-2e1d-5049-9421-b0b03e09aba7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f624cfb0-2018-5ead-a4ae-8e0b61cff98a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f570b6f7-7fb4-545f-b69b-7509b7bc63a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2b1e7f93-7cc1-536d-8385-076826b6b04c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:08136a97-25d7-5bdf-a35d-bb9573da0378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:437aeb22-0c24-5c4d-b127-eae4ecc21c42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d3dfa04c-c45e-5056-8180-f37750fd0ad8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:4a964be3-bade-5986-b432-4a274f472686", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:93ee0709-f1b9-53f4-a79b-a4e400e513ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:578941e4-8ca7-5a13-b8d5-4b16caf77d28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:cb12a746-90cb-5599-84d8-cf2c37047b1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d1e9a43d-44c8-503c-abe5-3eab9564ae6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:45ab84a9-3daa-50c1-bd1b-0d53ea258be3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:edfe5492-0b1d-59d2-b6b6-b59f42059bbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:faede4a2-b329-5633-8ce6-849a26a4bd32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2251723c-2ca8-5e0c-9ca8-c81c456e232e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a8a21e1d-17d0-5f54-a014-2248176b7ba9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7d8a06ab-68c5-505f-a39b-71f136e463f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:4de041af-0169-5001-8535-27675f3a94db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ca3e2f9c-dcff-538b-b83e-114033a59a65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:585f9430-16ca-5735-808a-9fd13e2139fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:890569c4-ff15-5adb-a6cf-ac75f892f460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fb25b101-643c-5452-8d44-8236ca083da2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7e544dbf-0ae5-536f-8c0d-816e27612c91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a8d60360-e53d-5e20-ad4f-8f32be7fd533", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:85b12032-1928-577e-b14c-7fb40228b6da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:85a183c8-18f3-545c-aadd-09cf1a1e7ca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:acefdaad-d60f-5758-bb1f-34d3b614300f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:900bce2a-eab3-50fa-946e-f088e80f51a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b93d0fcd-7472-5efc-8582-456a02dc2eb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d3138dde-cf2a-5ef6-9a9d-600030804226", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f805300e-d307-5403-ad08-94f1f937e991", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8d364f01-f61c-5bdd-95d4-953cc59dff0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:0801cf7e-691a-55f0-b078-b575c9fec271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:277182a5-69ba-5c1a-badd-04cfb065961b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7568d392-ffb5-558e-93d1-a17a75b7d170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.24-tuxcare.9" } ] }