{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:523c30ff-f926-5832-89f0-9d3f9d7cbc66", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:424045cf-9132-515b-98b1-2fcbf73b4553", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-beans and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6de80890-3da5-575d-80a2-e39da4f252cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d9fa064b-02ee-5cce-92fb-82910bffe15d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ca3888e4-7bc0-57e1-8972-44afe444a199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ed7305ed-5dfa-57f2-ace9-a296736955b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:812d4f61-6626-5413-84c5-042076566744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eb4a8d45-56e0-556e-8f7d-bc92bc75d7cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bb5386d0-1752-59a3-b35c-aa1a7c7fa50a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:def14ac3-ec19-5072-b557-dc2ec8e21a6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:644dfcf3-bc7e-51c1-9914-9c8e7213e8ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1f6bc267-c229-51ce-b152-8ebc30f43d51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ea1a2e81-ab44-51c9-981f-08f7b48cf147", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-beans 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:39ac4183-8be6-5125-a55d-ef16a77707ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1ffe92c6-a9c3-5f95-ba55-dd1178f1ab54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:476fc87d-dd9c-59ad-9283-94b78a107706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e8caff16-cc16-55cf-89c4-036515c8e7b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:86ff9111-c18c-55b0-a034-4acba256e1fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8ae79f80-1bf7-5663-89e6-28cdcc77577a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0bdfdf37-06e3-5e0b-86b8-4eb4c1af8f76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:27a85518-792e-554a-b4bf-2474e0d80187", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3d6b3edd-7be6-50e3-8258-08cd8d61b319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d592988e-e0e0-539d-9d26-3f4e677b5f00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:aa5d7d27-67a5-5c04-bb87-ea44e26e2a04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-beans. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5ca15df1-b911-56be-aa8b-9be7370a4055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6fbfce41-0c28-57d6-8a1f-27244815c918", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:684f74df-cef5-5183-9ac8-db3f992663b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e0f2fc82-ece2-5060-ab11-0933fd652b48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f635add9-0c02-5bc0-98cf-4ecf49ca1540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:06e5a1ac-91ac-5848-ab9c-d810aeff83b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:dda9a54f-9b90-529d-86af-57a055a995af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-beans. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:869d293c-af95-58de-b717-2c98a725f6c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b084a392-979b-5313-9a6f-98e45adeedf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:694e2338-cc21-5f67-9335-2c94ffff09fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:901f23a4-d06d-5e37-8044-cf5c6ea8522f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9a6cbaec-f8fa-52ca-88ea-3a88cca919e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a7c81a6d-be55-5dd2-b563-fa899afb7aa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9e1c4d3d-37bf-5616-860c-43e2ca7cce98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1d624224-00d8-5851-81bb-befb496bfc24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e8ba2bc9-6497-5f79-bc0a-0e934c5bc463", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:06b5da64-a370-5598-adf8-f318ba754a6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9bbb3eb4-0eae-5166-b05e-8757958417aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2396a3fc-e139-550a-aee3-38632f7a8586", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a532b62a-8b5a-5334-a096-49d48a73da5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c455ddb9-c7cc-5f32-a8a4-be4e1c55d19d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9559362f-8955-5d1b-9b37-32e17b8faa52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:45900e81-d402-5fc7-83b4-6001d95c2fdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fd2eb346-58a2-5f24-bf6e-342b8354596e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:34c55358-a793-554a-8e03-40b0511ea5ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ec93f8e4-350b-58d3-ae88-8f077cf30bbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:988f4cc6-5c9f-5251-8725-ca4062a8044c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fdea161d-34b5-57c3-849e-c04ab6914890", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.27-tuxcare.10" } ] }