{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0af84c09-f450-5bb6-a041-d32cb925268f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15", "version": "5.3.31-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:174be4d6-fd93-5ba2-bb6c-8ce7af43f284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.15 of org.springframework:spring-aop and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4fcac59f-4186-5971-ad21-9f39f3439e9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2f5c912f-0b9f-5177-b6df-bd62e96cb919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:20370cdd-4267-5c29-92ef-4d4d737c5f1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2b68469b-fe28-512b-b061-2d3436453d3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:39a24f27-c2e8-504b-9a3c-4ae42d82bdb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5268974a-6878-5f5f-98f7-7ed0137dd7e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f9a16893-5a3a-5747-a03b-9e6ca079c8b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:79122d96-8cce-5715-84de-d76d0445586a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d3a37b0d-a6d0-58bb-8785-a2f6b4611387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1e72034d-b9a4-5e66-a0bf-54f6e9296638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:e4a16cfb-918b-529c-9e9a-ac34cbea9cbf", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-aop 5.3.31-tuxcare.15." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:10322d86-3182-5bde-956d-2c5232a55d78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4173a75e-ffd1-5f9e-b799-b4d631aab984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:443a9e88-b789-5dcd-8468-ff61e329ddb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5b72a61a-bbfd-5b13-860f-c639b9295a40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ed16e91c-0fd6-53d8-a3b1-cd2459d95ec6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:74275bfa-f89f-5ca7-b2e9-6e2c05c02244", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:28fc2633-5a2c-5c04-a292-c3ea48f260c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:33a49f40-a4f5-5a37-9799-6a08c510e4ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:139b6b04-6446-5067-a395-af5c827a9278", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:31f0a34b-1f56-5c51-834d-ca64a4561ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:6a7720be-62b4-566b-8878-0e3394a632e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-aop. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:df67ba0a-31d1-59a3-9bff-8334737531e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a7c7ef60-3a36-5680-b3d1-f9d49e55b9a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:e9a92ad4-f9d3-5760-81b4-f48a5c5c2ae2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:11831222-d6e5-5dd3-8664-de4f52dc71f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:79fa9de5-9400-5a75-a4c2-530fc1052980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:0eed59f5-2d7a-5a8e-92e2-083ea48ba166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9a138f43-a660-543e-a2d6-3362e08901d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4eca47e4-efb0-5982-96a5-9452f3517785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:64328bd7-bd00-5290-b4f3-f4ef4f8438c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:3ec32689-3793-5e07-8d97-1efbda8c0eb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:35fa5778-7ce4-5ddd-bdca-91750319df5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:274889e7-f3c1-50e8-b915-b32be9771ae4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:30d446a4-d18b-502b-ab59-8a12f9397c9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d8d1eea5-373b-5140-a2e8-22fa7dc8216e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:1547cdcb-d41d-5413-a12b-c6a96c59235f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8b7111a9-c72f-5455-88b7-6d31933d8b46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4250d729-f4fc-5313-9178-bca91074cc21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:36cfd7be-0054-59f8-90b0-99b1409c272f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b168c438-3fea-5393-8351-510bedfcf31d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:64320193-c0ce-5863-a07a-46ca8a40abae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c6ad1a3a-6d02-510e-a603-0535ec63cf56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8e65d326-4d7c-55ae-9049-853cdb8c4d9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2f9ba7cb-5de7-50f7-bf96-918084fc21c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:580997f2-53a4-51c7-a2f2-f9de811c1ec8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b3ee3680-e192-5372-88f9-740a3091f89f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9cf4e363-fc50-50bc-93fc-4c78e4a6d1cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8b5f7d01-cfdd-5063-be0c-50ba61de5089", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c8cc1b81-de01-5ca0-8713-2d9705b5e2a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.31-tuxcare.15" } ] }