{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:233e2d96-a189-50ee-841e-a4e2db73ecc9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:db845db9-6bba-5492-93e9-77c1e3d4e856", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a1676881-3180-50f4-97c4-347075e9f9b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:11bdff85-4c2d-54d0-a0fb-93daf6ffbb8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d3b461f2-64c2-5a2f-a1ab-779fa197dad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ab9d0677-e189-5c2c-9527-87882d7bd0b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:73e40814-7237-5a0d-830d-4bca853fb342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0c519ebd-443f-5fe0-9c1f-371239b19a83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:054ac19d-9c47-5efc-90ab-549ed45d25fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5d8c46a2-5e15-5512-9e4b-040ad60265b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f28dcd30-b611-5e6c-baad-1247c53923a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f8db8102-0876-5b72-811f-4c8173844627", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ba439f49-569f-5baf-bf06-0e3cba78b7f9", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jdbc 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:28527d4d-b47d-5a25-b687-2d404865a6ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:be41cc11-9847-5156-bd44-5d08e8358a67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:398e5111-1cc8-5396-b7c5-daa899415cc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:397a175a-afee-5f2b-a77c-50a61e0d8f24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0448835c-42eb-55c1-a477-e4eac0e2e29f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:52848fe1-cb94-567f-adb0-564c4d50b7c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0fa7e6d7-dd10-54df-92ec-f509436b1da1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ce62b3d8-169f-5552-b421-0510f6f9b0e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0fe97a62-b42b-5a47-9cda-c52cb3998385", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e70e02a6-16b2-58e3-8578-21bfb678af80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7ea20081-20b3-5cfc-8a70-dadaaca693f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3a42637c-c2e6-547b-8576-97b6454a7d95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9f145613-7ef1-583a-a174-7e9cdd11d6b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3b5eb84d-1531-5983-a639-2237223d6d95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:14048eb0-ff4b-5649-b9e6-e07590af8f03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:65e91df0-38f4-5ac6-b2e6-72c58767fb9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ffa9204f-b096-5496-bb90-30627dc8fe25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3badba6e-f7d6-591b-ba76-54cb609a264e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:36aa8d08-5683-5a1c-9441-2a124715cab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d9d23296-9462-591c-8d8d-0aa4da283c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:75c467a1-f751-5926-b607-dce8b14a43b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4fdd52a8-2d41-5682-a9a4-167e9fdc8986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8909c523-cc9c-5fe2-9d29-f9a39d019d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e65d31f7-1b93-50e3-ba98-e0f54ca0da03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f4b86f0b-a128-5a22-b23e-857b71e490fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6f95d408-6cf4-5602-8357-9ac979260e37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:876b9c76-4a2a-5bf6-bf3b-9a0f49c27e55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:855501b9-e4fb-57e7-9f8b-c1a699b8689d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1daf6b6a-7282-5ecc-a1fe-d0051497c81f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8ae78bbd-8880-5794-8c5c-54dbf21ab180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:480f989f-ec24-5f93-9300-ba27e399d4ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f3b75f09-7a3c-5a74-ae66-a25ed6fb3e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9f38165e-70e6-5384-ba3c-ce38582ac797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:debe4e08-483e-5427-beee-bf5197ae58ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d3ce3e3a-8d20-57d8-abf4-862398a8d6b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:863ad9fc-521f-518c-8176-a81dbbaf8518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:82d4a08d-27dd-54c1-80cb-5e43c627e421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0c393c95-a5e7-5739-be4f-81a8b74bd152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:487e7f15-4d65-5d1f-af70-95ee3565645c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.27-tuxcare.10" } ] }