{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cd02f2c8-c8d9-503f-a564-9f7735fce067", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3d0d1edc-0f93-59e0-9b5a-b89af5c92e3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:127ae477-0fc3-562b-add7-dcf4d43f1deb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bdf5854b-cab4-5b45-9ca8-e29439302e0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f0a1f226-362b-5bab-a4c4-a512ffe7044a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:707cce5b-baf3-597e-9d53-9045820337da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:610f61e3-955d-5637-b187-be835d2ee196", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:11372715-0dc7-59bf-bda0-51e38f52ee57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:966e19a5-6162-5890-b84a-7d7cfcd0f659", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:673e47dd-7ad5-5cc6-b083-46130d375ba7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:936bb651-2c57-524d-97c9-2e28e69f697f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e407040c-8daf-5e1d-a2b8-849ebc1ce1a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:33a04f8a-f175-527b-a4d9-3c637643ed1b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-webmvc 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1881dde4-80f2-5f55-b64f-77c2c29c6834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a9f362f8-5168-5c6b-8ce0-0e9d0c94a954", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5f1ac76c-dfc6-505a-b21f-dac31d085bf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:08caaf76-c766-5700-a9c7-c5494afe9ddb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:668c5ddd-2b98-5ba9-a329-f232c6a6e419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:719bb176-59f5-52a7-9e87-3eea4aac9591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3e3663f8-71c4-54d8-813d-2a766da95cc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e7896bd1-48bd-5961-a12e-9c383ca4c215", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8512ad03-a869-56b9-81ab-2d9e2dfb3372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b5ad0b09-4ec1-54f0-87dc-22a31f104e82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c06eb93a-ed89-5f49-826f-a25c52ba50c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e94ade4f-54a1-5a07-9210-12ecf15fc845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e6e51f21-d721-5405-9c97-dd5cb38a4bf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:76c1080e-abec-5311-8c79-2bd5e8b63899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:97ffcd30-44f2-55a0-ba40-633d6a25ab4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:af49d2b5-b6fe-5622-bd61-0fda8612badc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:22af91e7-0d35-5f63-b8c1-57def3d89740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1884ab2e-4809-5d2e-8c2f-f5856df6a132", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f071b3d5-d124-5e87-8341-b2b60a3ab38d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0e31040b-4e3d-58a1-b693-a3d4dbda18fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:43ed7a90-7e98-5e1e-a095-4571c22f56ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cb5d3f62-a319-5310-9830-cf1d8f0bdfbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3daf3120-3708-5a37-9a55-f545b5505da2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8e1c3982-9d33-54cc-93cc-bb8534d1680d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b488c136-d807-5936-b85f-6d4d281a20d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:428ef86a-c359-5ea4-ac44-e978b7295344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cc70c3e9-c77c-5af1-a342-ce12c3dfe40c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b712e49e-5df7-5c21-954b-65a5a3df306e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c7debfee-c192-5a0b-aa9e-b494483d4772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9e8c60e7-9810-5b29-a388-6565c74f9be5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bde0b48e-1e8b-51c9-ad35-12ffd934dd4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:edf061c4-79a6-57bb-95b8-8ee3dd20823c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9c7cc5c1-e845-5b5a-b6a8-697178756263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:51a08242-7ba9-5be7-84d9-f7f7f0532127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a7434990-3d87-57c8-9ad7-5ba4aa2682e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c4d290ca-d5f9-5a09-9a5e-aacf38068872", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e5de6ff8-0663-5eae-9b52-64d9f837a6c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:af567d14-5acc-506f-88c8-e0d2918ac924", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:166c6d8b-b31b-5ac4-9386-45c243ecf305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.27-tuxcare.10" } ] }