{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ff15b680-d384-5945-a7b5-2103dc04bfb8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0d82a5d9-02b4-5297-a49d-c2e9c30eb711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-aspects and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5b4fc8a1-2f1c-58f1-b5f7-3c46737dcef4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:503bff58-ab0c-5ec9-9cee-875d2e99d169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:76883c14-0bf8-54e6-9a62-6e87438b7521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b5665af1-3317-5c1f-99ae-dd6c1911119a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8b3318f1-d868-5eb2-8381-9f439b8deccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a329367e-c4dd-5164-af07-23bab876c928", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:242b13e4-042f-53e1-bd14-c6f0cd02ef97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:db10a172-d129-5316-b4c0-ea255cd4822f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5a753b80-87f8-51c8-b216-24892c663ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:23631d64-e16b-50b0-a6c5-766eba24fea8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1c663c12-673c-541b-aa0b-5625ffb7ad39", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-aspects 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bf864128-34ab-5fb8-bea2-988ad69ba61b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:67d2b08d-2c7e-53ef-ad0b-548582b46447", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fe94215d-f30a-5143-a861-8be6e79e8eee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4f0e362b-182b-57f8-8c50-23ae08832985", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:94b7be93-5ecd-557c-8f21-6fcc97ccc871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:57bfd136-4565-5bd9-86b9-a886ffd4909b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:85f539f9-3559-54aa-b9ea-59f4f1721871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:86996fb8-033b-58fd-a7cb-4c2bae6ab0bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e0ec4158-65fa-5909-8fe6-b122783e04e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b4d28627-0039-5438-a389-292f356016a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ba7759a8-7b91-5f66-8bb8-23014bdd4d3d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-aspects. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c6393d7c-21f5-5c5b-b430-3cf7945efe9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3d4225c1-8348-5fb2-bd1d-6611ff357b28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a96dc8cf-5072-54dc-a658-3f57ff96a35b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5a57f510-aa40-53bf-822d-7ce0c6a2e31c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:41f1381b-2b72-5c65-9a76-35713f656819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3c62f8c3-9502-5790-bf9b-490dfe0b68dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b9e03c72-9195-5216-8a19-23dd99007ce6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-aspects. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:be803022-7e9f-53a8-a134-60a1d8b97ea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:78dff876-38d6-5700-97d2-70a40c9f3c92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a0df2686-1f26-5463-a5b6-68965e05e6fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a46a1caf-6ef9-58f4-a8a9-70e2c21e0e01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:984b16aa-47ff-51ab-9fd0-69c61e2043a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:94bb8b2a-12d1-5744-bf28-a4e6b13f2b25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:25b4b539-2870-5acf-ab4d-f734aabbae15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:aacdc905-30ee-5b07-a08f-8eddf3e17c8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6ca7ba2d-1412-54d5-9653-56dac16db1e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eb923e49-abb0-5926-b029-c6a857acebf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1873bee3-5f46-5eb3-b059-2c7d8467203b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3a2efdd7-2ba2-59ec-9bb4-22dde6680ed9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:579bdfa9-7147-5624-9513-7421c7f2691b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6b94b158-8946-555d-9fe7-8a76300c4ce9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cb732aa4-b5bf-558c-80c2-773a5b63cbb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f67192c6-d879-5f00-ada4-0361b4d81a9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8b857c84-ac9c-5ec4-8c91-fc6ecef9e58e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ff6ae551-76f9-57f6-8855-6634e928cb59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f9adda8c-eacc-597d-b9f2-31f01b6e1050", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eda8b716-8580-550b-aceb-f4f1f3d07166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c25e83c7-13c4-574e-88b3-6832d6e10b55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-aspects." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.27-tuxcare.10" } ] }