{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f5860ec6-0068-5fc6-9d70-20cb0f1c6569", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cde85d74-e497-5612-8928-43e78b011de8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-test and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:87553f0d-1733-56b2-86cc-dd8bfcfb6159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4f0b90e0-f953-59ff-83cf-e271b785154d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d2cb385a-4076-5dbd-84cf-18ca1f95ea2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1fd90f14-d4bb-58c3-89aa-1b02e16967d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:23e3fe67-a5fc-56be-ac73-6c2c5daca0fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:55633c9e-2248-5c0e-9492-a0359dc7655a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7218605d-827a-5b42-bc8d-817c43e318b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e8594fe8-fa2d-5eff-9538-7aaee2db3442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3154a099-2dee-500b-b17b-d70ce0cb92fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4df1f06a-4e3e-5a12-816d-ce32cf71dc64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:789bdce6-affe-5942-b3e1-7c316744aa02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a6577d94-b9a3-5b13-964a-1f6737551f9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2a59b900-7091-5f97-b9fd-40a7b926b9b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cbad655a-74c8-5b54-8e05-0636162a49ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ba1be396-ead1-59db-a090-d024e54ffa49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6127246e-364f-5b31-b6cd-1572b58c632c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:736565b7-e6ba-552e-b3bc-7dec1833bdd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b6ab0936-c25a-501f-95f9-271963f29ea3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d9248b13-22e2-5d39-8791-904b8daa7346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fde25094-90cf-5795-b00c-d7c6dcf623a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:71153d4e-b31c-512f-83e3-31840fa8f867", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bbe2c855-aeaf-5e7d-9441-41678eb29dfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f8b89eb4-a345-52cd-9978-e7f95a673086", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:774c021f-1b1a-5d3d-86b1-7d66adb87aca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3d1c6111-28a6-5cbe-9b61-1b7e417812e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:27f165ff-332f-53c3-9f66-73099bf45e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1bd02004-a17e-5b7b-89eb-68af98356fe6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:45f7c472-bd5f-5a5d-924a-fb7fbaa9ccd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:62889d56-4ddc-5abb-8161-d7ed27857cd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ec1c7b54-075d-562c-aeaa-921554140992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8033ba8c-cf07-5b8e-9868-736595ce071f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:70db7b1a-4647-5437-b300-23b576ab4645", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-test. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a3161272-f055-5d5f-81d4-b90d0a82f79f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2b2ea43b-371e-5119-99eb-5c3df48e24ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e8130fea-2383-5da3-9daf-b4e08793e17d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f8402c10-38c1-5afa-8f45-be1e57590c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:273e8b5e-07db-596e-b4e9-90866f5b8f48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:60e9c9fe-cff0-53b5-96ab-caff6674d80d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9bda4fa8-5bca-5682-a44a-60f141216060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bcfee34f-8491-5e05-b867-fac0c667bc96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:71b2124d-044d-52f3-a7f2-38fe17c0f15d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2f542e5a-2b16-576a-899a-a58fcb129570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e2d0d97e-134e-5854-a8d6-147f326752ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1304c29f-a900-5643-8b07-24c51bab8449", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ec98d114-f9d8-5242-82f8-aff5b1092fda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c94bbda6-e076-5692-95cf-599983a34eff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-test." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.12" } ] }