{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:adca49a9-d085-5df6-b100-055c067f7586", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:077f08e5-ac93-504c-bdf5-bb0bacb5fd59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-context and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:12d3f1d1-04c5-5017-b035-359291575eeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0c72cf77-7acc-54ee-8914-efdad01680ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:df7e5124-4633-5c23-bbc7-0f587cef8eac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e03fdbec-049e-523e-ba3d-64ce6c15ab27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bbede3f6-a3e2-5559-813d-1c89c184cb4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bd26e006-83b8-5531-996d-6328a67041e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:62a5036f-ba9e-5314-9a15-6c053eb8ef9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dc1d831e-beb1-5766-baa3-f0b5e175d4e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3ddc6e26-af5d-58ca-8273-d1f487f96319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cc06764c-6583-5353-949e-3ae06601b9a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1e1c94e9-78b1-55a0-a082-1ea6c31d763d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c7367b9a-c086-5179-9d26-2f1c988e571f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1ce8b6ff-9c14-50f6-ae64-8d9dd94df4fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f65fba98-cfac-5356-b1e7-f83660e28346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a63789c6-4fb2-5da8-9614-f6b79fcb68a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d2f30177-0b24-5543-93e7-098fa3d1649c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:667862a1-af53-52cf-8cfb-ae9e66a8330d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b95d61a8-09ff-504d-bef8-a839cf1594e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-context. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8df997dc-9e99-51b3-aa29-fe9ce564c26e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:783af54b-4546-5e3b-a39f-ec20ee805a39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c4d995a2-a71d-5232-a10c-806b07e03102", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:248c0803-8fe9-5d2e-9ed3-43b2bad35e8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:13bfb245-207b-5696-a565-4be619bde36d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:885e2ea2-06fb-5d12-b43b-0ac1adc5160b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:af18e878-c200-5bef-85dd-f55f20b8ac99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a0644722-31ea-566a-a16a-059da52471dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:25ce1dce-0f7f-5b85-985f-1db39dc8eefc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-context. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ba512421-3017-55f0-9680-5422a265966e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5c30a45a-83c4-5878-acae-3811787eba2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a6da9a96-427d-5aa0-a433-f5149eae71b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:445034fe-a518-50e4-a21d-05d55059f487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ef1964b5-4c9a-55ed-b89a-b76c7196bf75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-context. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ad01851b-b5ff-5346-b918-75eeb7a8a565", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:12585bca-1406-54da-a0d4-900ddfae1a5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b2c9716f-28cf-5a79-94a0-ee39ac8ca0c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:056072f8-bb26-599b-891e-e48d9558d9f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:354ccecd-ae93-56e6-bc33-1276f047aa40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4468ff96-aef3-5aee-ac64-c845d9d3c597", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6f63b644-ec9e-5d3e-852e-49f46ccb8e3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:40d15117-0c63-5871-a1d8-9c2b602a1b7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fc6ce121-4eba-51eb-a604-f0e06e570542", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:66098034-1591-51c3-ba9f-4bbbd6bea54b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5caf3232-cf29-502c-9199-32effe017853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cb84b772-d5fa-509d-a04a-3df7893577b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0637c1ff-44b5-514a-8ae8-e26f28eabee9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:36ac9b93-0f96-5aa2-9c75-295194badd8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.12" } ] }