{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:03f7fcab-ede7-5fea-9145-51f585502cbb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cac96be3-d0ab-5e19-b234-bffcce8fdfef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context-support and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9a8f81e2-62c1-57a2-a2f7-cbd0ee6377f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eef87ce6-494e-5aed-8ada-1e9fdf72dfb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8abe2fc6-e75f-5217-865f-2a33f50b9ef7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3790f58d-99cf-5cd1-9238-a880df70f0ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:160989b7-2128-57d7-9094-2141d75852c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9bb19436-abbc-57a2-b425-93216d1125aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:33f2f239-5220-54e8-a523-5f027c0e1575", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:99ecbada-9cda-5f1e-826a-469e991edeca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:477a4987-42c9-5f40-b486-ca97e118b3b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fd553cbb-e588-59ab-92fb-d5848207716d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:841c5ecd-1da2-5d6e-849f-e746342b23c4", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-context-support 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bf4f86df-9cdd-51b5-87d5-aa49730ac8b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:504d554d-98e5-5abb-995c-5e4f74e75efb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:228c70a1-9b6c-53c7-ae96-d4abbcbf9c0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:55064130-5a5a-525c-9d79-fb5757d9aae1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4d5ad1e8-bafa-5db4-b8b5-7357a67b7bea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3d01edce-78e0-5dfe-9933-43ff584cd394", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7c1c7810-1d12-56c5-a67c-e4ff03bcb28b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:62bd5e63-098b-519f-bbf0-56da28689a2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4ab9ffc7-2c41-5b7d-89f5-b6ae5808bf48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f2faa6a2-9475-57ed-b9b4-06b0f1a6dc62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:48cae5b8-16f0-5dd0-88a6-e23da534a55e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-context-support. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:690b7728-00ea-5628-a367-40302920752d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:21287d78-7913-54d2-af44-ff48ae232a6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e2893230-c16b-57b9-9a70-5b1ce8340614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:10723dc9-7533-5969-b9c6-7a659203a3d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5f89347c-2ace-5350-b41c-17f1ae47bb5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f196b7e9-3cc3-57d5-b5fb-03e611cb18f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3853422b-d235-57cb-84fb-635d84cab942", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-context-support. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:756fafeb-1d9b-5696-ab3e-2e3c1d90a684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e2ac96be-8b87-536d-89e4-155151bef3dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:554ebebe-f0ff-55cf-85d2-ccd3b041f9df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4505d0f7-bed3-51f4-824a-e0abc5c42297", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:dc33a6a0-52a0-59ae-adc2-53d16be916fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:827569d0-c146-5ef6-867b-2e7ddd8837b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2ff3c14b-a28b-5239-8583-523f252ca46e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:489c1e0c-9bbc-5cef-a881-a1f1595a5fd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ef84cfcc-9bc3-5dd6-a6a7-2177ed37bbe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0120c4af-504d-5fb4-b8d5-1363a459ce25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1993c8d1-6bb1-5267-a47f-0f53b1fff3c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:76c813f1-e2a4-5393-b3b2-fbfa3f4d57da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ba02458a-da5c-572c-b70f-2a7137c84071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:44b9da94-9500-5577-9af9-483eba527531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:77e11fdc-5114-59c6-8385-6f1c715be41b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e53fc37b-d255-52d2-9770-e357e09d5fd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:38147332-5866-521c-8dfb-45c18de2b8d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:30529726-aa15-5121-8900-a1f91e1329f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2905487c-ee53-5178-a47d-eeac96edb5c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6d2c94b8-c280-5780-b5cd-bc61f5aff3f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c20f11d8-ab28-5ada-b42c-79f75cf6d7bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.27-tuxcare.10" } ] }