{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:85e4ce45-1f9d-56cf-b313-c9e80d937d64", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:95e85649-d632-5bb7-9ac3-31b618a62528", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:557a9da5-09cd-564d-92fc-4724b10a2992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2fbe3722-66c2-544d-83b9-6b0eefc22811", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1d30a996-367c-5800-a5d7-0b75e30eea95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:73dfd176-63be-5c49-862c-39d532d2cd03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1c0b62b3-948d-5d3d-8ae9-256214d58810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f44ee53e-3bd4-5494-a4f0-14e320be7e20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:235a1ed9-86eb-5303-a84f-c8c564180b0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7f398f02-1302-59e3-9c65-d7ff69511d93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9d77663b-0930-520c-997c-3d29625d59d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:acd5b639-00e6-58fd-acb3-c655aa4a9141", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:056e58c1-6b10-57b3-a7e2-bfebdbe767e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:082e06ad-6cfc-537a-9497-109a5956e854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8ea425ed-9c26-5405-a90d-f35a6d314ea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cc7a6bd2-a93b-56f7-9d91-91cfbcf3fd0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:94767c83-919f-5364-8cfa-026fa2baad1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f02ba07d-d736-5560-85c1-17b6e0079c98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9a599193-8e3f-5d28-9594-fe2f336058ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2d431345-484c-533c-8f5c-85441d3d824a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-orm. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:29f0db68-31a0-59e9-af7c-282cbae718cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7665b1dd-3f42-508f-b3bf-ed33f882e21b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:06c9c9cf-8642-5124-bb35-6f506feee3f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:de28195d-94d8-5fd4-bb82-aac0ea2729d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:52a06a34-9574-5bf6-af78-43de1d5bc164", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0cee2a88-474b-5322-a092-e70dc4363cb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1b02da5f-84e8-5e7c-ba4a-8ef70a60d3c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:eeff0171-db18-5249-b43b-ee91c02cad81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:597513b8-7982-5b61-a7d3-64916afb335e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-orm. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3941743a-6f86-57ec-afaf-a7e8e20481fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c25a323b-53ca-558b-8acc-3152a4f56bd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:29ac14e4-d97c-5b23-9ec1-ddc43f2632e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c1d38d46-8a41-5e73-b07b-5afa576380e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8fd221af-6f4f-5340-a0b5-9f6dcb021ff8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ec43d6a6-dc08-5f42-aac4-b142db998b6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f1e8584b-70dc-5c5d-9ddb-936a25e9afef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a1c28a93-1411-5d8b-ba16-7098b99db5e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d5d2adb1-9c28-516c-b34c-32029d5d6f09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7682214e-c1b4-5df1-a950-b4195d663587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:61ccf937-8e65-5920-a99e-f58eb9e67596", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3830104b-324f-5d4c-8118-171f7cca5abc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4ca082bd-2254-5e1e-ac9c-a8c7175e5607", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:51d83d28-f035-5413-b438-a24f7f8b36cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:848e4cb8-6b15-50b8-a921-5c1a0aff2a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a57ba5d6-c504-577e-a7a1-10862bc21aa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e360a0d2-f3ec-57a3-8176-05da9ae60bc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f76c5d80-d534-58bf-ab79-a1993b1e1a48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9da13881-ad40-5ff8-9ea7-c46f5cb14d9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.3.37-tuxcare.12" } ] }