{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:026e0035-4de5-5b9e-97b8-f29844fcb8a6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eb39e3e4-f162-5c41-9200-c0588ae3f08b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2b7b7439-a1dd-5836-b1c1-53129970886f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e4d6aa6b-10ad-51df-8362-a48bedd1c35a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:97391edf-e05f-5a13-b09c-010d339858e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:05cbc6a0-2fb8-514b-a392-fbef8cfd1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6370b9dd-df20-5214-88e0-fb55d3c6d690", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7dec74a5-26db-57f1-a7ee-444c3aeca3c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:290b3986-f770-5ad9-a0d1-f23b6268a527", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fdab17ed-ebec-5f92-beff-cf1f4ce6026b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:55e44148-b900-58af-b2be-753c0eab4f20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eda638ae-603b-553e-9e98-f59c3e1d0d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5d5aa4d2-1fb5-5ac0-95a6-ee0c9bc80d5c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-context 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9e790e40-5b49-53a3-8902-0a58d7df4848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0e05602e-ad2f-51ac-9f0f-5e5db594fe74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:caf82bb2-6e9c-5a61-bfd4-04b8d8d70308", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4b482d24-c448-5dfc-aa5d-8fab0034288c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4dc704d9-e2be-55c7-912f-e33c163f9ad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:167531ed-81e3-5d0e-9ab7-d64e58b57738", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:28fa9b73-6796-5dac-93ea-2be6fbe01e88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b98ee6d0-fd73-5a92-9c88-6d66bd2e577f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2f4b5249-84b1-50c3-9b2b-44ed8acbb21b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9a346be4-f0ba-5bd9-8463-7d27a4cb99b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:97d02692-0026-5bb7-874a-248a813a8fbd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-context. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b8597e8d-c092-57c2-a5a8-175c65f9213c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bc9499ba-a107-5dcb-b0c4-5803e7bec489", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:77d4c26d-d9d3-5437-abcf-78b53d314871", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e0884ca1-7ac5-5a9b-921b-0be93f1799b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1eb88ace-6ce9-59d1-a82f-9ee3e1cbb29a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6d0186c1-39b7-57c8-9ae4-0b9b80e88341", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:41992c70-44de-5db3-b8ad-21b24a6835fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-context. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bb3c717c-9584-59b6-b9db-a57ca30fa65e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5b7bf07f-a616-576b-a554-da02b564c1e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b603267f-60e6-5116-9948-9b903d3cc53d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bf942501-51b7-5052-b531-84895f745928", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5242cf09-52bb-53d0-814b-6cf4d5cc8fe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d644c191-da77-58b2-bd58-aa0f65662819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5683aecf-86b6-52c2-9f3f-853eb8df96eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1a00e32b-62ce-5fff-b04f-e9bf278b4192", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b16397ea-137a-56ef-9326-116c993fa4eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1cd4b060-739f-5ad6-8146-23a2d1c56194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a8f98ae6-e679-5a06-9de2-d57f3abcaf73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c053e176-f495-5f96-a49b-76b6470cf1fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fd5ac82d-147b-5af1-8a39-550eb89acf42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e45b0c12-2741-58f1-8061-04fa7de91102", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:dc966599-715c-5796-a04e-cbdf3bc4a4b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:58b764c8-7b30-5430-8f42-adbc9db3323b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e72cfe57-bb34-56cb-a913-ececb402729b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f469c83e-7569-5587-b003-844a80d6e047", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:80f74d20-e2b3-572c-94f3-80f75f75ba9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:100a7d64-ecee-5904-8eff-bb3ebb6a2a4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:503c8ea0-2150-5170-9e6d-407c0ecb5b58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.27-tuxcare.10" } ] }