{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:810df47b-061a-5db4-8f58-683491d59604", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring", "version": "5.3.39-tuxcare.10", "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f1f9c968-9a06-5d37-a5a7-b09afad8b400", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4adb5765-cfc3-597d-aab3-fbd9b4565c9d", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.10 of org.springframework:spring. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:519c17d5-5526-547a-a127-b73da5f60c4a", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e20ca2b2-9c4c-50e4-8595-c6bf4fb0677f", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3e17963a-4280-5e9f-8dba-3eafb3e8a08b", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:567e6f5a-e547-5714-92ee-61479e9f0dcb", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bde09c55-fc94-5cab-b8de-8365ceb1d532", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:423913b0-52ad-5596-8dd5-9b87e0c56a9c", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.39-tuxcare.10." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6446222e-2f3e-56d3-aa9d-23aba56659a2", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3d811ad4-7d4c-5aab-b8d7-5f6a114e715b", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9487183a-3d54-546a-b6d8-cd03654fa178", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:14ee06ff-c455-58d9-9976-a924b6fdc9c9", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:09322067-fcbf-5ce2-99ae-ad8adc92e0b4", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f647cd1b-7bad-5c38-af36-c449a995c28f", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:dc38415c-d5f2-5971-ada5-c88053363ef6", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c2ec148d-a094-51d1-b0b2-bb3035e2812d", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8fccfafb-7bcc-5288-9497-d6bc7fc06716", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c32ce09a-6d0e-56b9-8552-a3b0ffd8819d", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:831a2598-dfb8-5975-8307-5b86f69b3ce7", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.10 of org.springframework:spring. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6b1cd8bc-8ea7-5e6c-93f3-ae328cd9a048", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2f8df174-6d0f-5b82-a902-b7509debebf9", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bb9967ca-fa68-51f9-9c50-e574d7cfa69e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b551804d-7b95-5fd8-8cb9-5117ad896d0e", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4b328bcd-5543-54a4-9a94-679b66a3ba0c", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:31aef29a-b83a-516c-a89a-2dca1b97d664", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d224a223-4707-5215-b7e8-7a29fba4983b", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bf687cdd-f8b6-58a2-b21a-f8519a7dcb49", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f8be3100-0ec1-53c2-be8b-d53d67018504", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:81b4792e-ba49-51ab-8cd3-7d459188a614", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7ff88747-5af3-522d-bf5e-c383c8d573bd", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4c58252c-e13a-5279-abf2-356bf26e73c5", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:705f3762-c5fd-5593-a554-1822e3ce7ee5", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3183f0ed-75af-5f58-aa03-1d158688eb94", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.39-tuxcare.10 of org.springframework:spring." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.10" } ] }