{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bc957d7b-a608-527c-879e-6c201d616749", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e3f39469-ee14-5d1c-a286-9361592776b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:65e772c3-0c87-522a-bc5d-e910dbe44d46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1f813dac-291e-50a3-9c7e-14f9b953efc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8fe1f79f-ec8e-59c1-a768-a83ec6df71c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1b49022a-c49e-5a64-9cb8-f3907a5350ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dd26cf93-88f3-50f9-b16b-a5bbea19d275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a3c1ba7f-8fcd-5450-a233-51b21b91e7a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4d83ddc2-f38d-53fe-b359-c616160538c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:97e77b8d-ed8f-549b-8f31-bb3f5e2c00bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:449adb34-e10e-5d0a-b635-7ff795c3c18e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:56e51466-1eea-5c72-8aab-44a92e4ea254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:665360af-c078-57fa-9afb-86262cb06667", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-aop 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0d4de5b6-4824-5c10-8bb2-67a10e6daf47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cee55478-3bd1-5322-893a-b5d3b44d4b64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fefa69c6-e6d0-5299-b7a4-ccc1833e2c83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dc17aece-3732-5365-88f2-6c02690267bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:34fb9b44-5031-54ef-ac59-1685a991c49a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c9f3ec36-60a7-50f6-9db4-0493846f8391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b9af866e-8132-5fbd-8300-fb386a7134d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:00db0cda-d6f5-5d9f-bd0e-55354afbf5d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:da9b4b50-2e51-5e74-8fa3-9b90b0ba1843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:058486b6-059f-586d-9a78-a616be594fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:98b9d519-4d6f-5e17-939a-4934897d9986", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-aop. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:87715c74-98b2-5920-bd0b-5033a6020718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d11e8b99-6597-5d59-8555-ca209e955054", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:874343e7-d48f-552d-82b2-39569150862c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7ac50935-aedb-5538-9a02-9a3b34585462", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7e1707ae-c40c-5428-8024-32bf08870624", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d5ae69db-b7d1-5cd1-83c1-60c20d14b7e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a1c06eec-b13b-5a94-80d2-a4ec9f29d95f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae2caf5e-f366-57cf-bab0-7776a56e8801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c581a60e-277e-5210-81d2-fe10b6cd5d0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d2f8dcfd-061c-5404-8f61-6a13a7b61521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4af47e5f-8f83-55d9-a463-e206a94df83c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:85e8cff4-1ad3-5edd-9a93-46cdea28f428", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9c37a859-1e60-5194-92ea-9e998b88d416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:94d8d19c-428e-571f-a20e-0540a4e23dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9af00100-f7f3-56aa-9cc4-3e8831ce25f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7c909e7a-a07a-56b6-8b14-cca0db64380a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e1d90f2d-f8ef-5770-87e8-4b637523feb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:95232b66-ffcb-5087-bfb6-8978d8053dd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:51893f69-3e29-5c37-9a33-479f20a02e1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:de124995-aab2-5614-86dc-6353f7b74627", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:94a40797-23d2-5b45-960f-bf856aa9dca0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9ed1f12b-1344-5687-b365-0b8398dfd2a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:50f16cb0-2a9f-5069-a4f8-4c7a205df1fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:998eea72-3e77-5b40-b3d7-0b976b0e05e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a1a17398-d462-5f62-b37d-a34b21c6cdcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:15508559-1582-53ab-9cc5-e2da7afea326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7f5dde3a-31c9-530c-93d8-2819784ab878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2855770a-d60d-5663-836c-f3cf8282a231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11" } ] }