{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:145287de-0ecf-51af-85b8-63ef1f559fa0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8c194ae8-3b86-52b1-8cd5-820fbd1d4e7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:71f8752e-a389-57ce-b8bf-fcaeb8316df1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:67c2693e-9a4e-53f8-9630-a51e2b431f36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b417c3ce-e2f6-501b-9b4f-b4e9b1b112ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bbbddd39-a908-5d17-bcb1-e59f7d8b796f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b2fa59e4-5fc0-529d-993a-66788480faff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:11e9c2ac-0d58-50ce-afb9-f72dfe62acf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f79714c4-cb0d-5e01-8002-78bc50eb490e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b852c855-41d1-5889-a3c3-0254e8874e13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ef6e8d4f-7382-5817-b237-a0641756a9c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5c942533-e466-5066-a8dd-a96d7f4afce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e1185ada-abdc-513f-b58a-61cf70811577", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c1b37dd7-eb63-5323-b683-6a3f7d5651c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0a25df28-558b-5ec2-841d-e235cbb4530c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e04b3f37-847c-54ef-8b04-1591142df992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fa6795c0-eac8-5173-bfb1-7397d6b74739", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0f1cea11-7319-5165-bbcc-e5a33a3b916b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:34dba4e3-2fa7-5463-9522-00b3758c8e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cfe23081-c10e-5cb0-87c7-78bcf7549e82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:92750931-81b4-504e-be75-0274c3598a9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a601d6b7-fe11-56ed-88e8-471955eae3cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a244a202-59ae-576e-baab-6df9722e3996", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:092a8af4-9709-521f-994c-9a2b7f84073e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b7080c48-33ef-5df8-818e-6c1410e6a707", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9e853d26-36ac-57b5-aa44-d6613e76fded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3103ca3f-f043-5c97-aa66-125c2fd27c52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d8019f7e-7a9e-527b-b6eb-aa89fc7b252f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6e92146f-ae2b-50bd-8152-7ca7aebaf6e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:09a28ec5-37bc-5a20-91dc-e58ca0dd7a77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3726014c-b19a-58a5-845a-4d266f69dc4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dc89b741-2e5e-58b2-9f97-4293eb6f9c49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d428d5c0-97b6-5a7f-b9b3-f7eabb9e2ed7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9290cfa4-465b-5290-89bd-122ceed5acd2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7501a9b2-f03c-562a-8e69-f29a1569873c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d847edef-c1ab-59d1-858a-1f7dfed469e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f70653e0-85a4-546b-8329-d0e1b5f128ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:120b0e50-7a82-54ed-a000-050a882f8a3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:749dc336-9cbf-5c71-99ed-de6022340dc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b1b10733-c807-5c3c-b41e-92c065b5676e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d49c383e-ef22-5c94-aa9c-caf485484eec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0a6be571-1960-5c73-90eb-4d50ce28e627", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9ca25e98-9f02-5e52-8751-5a037813c229", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0d6e5d48-7179-55ae-83a5-19b749d44807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0a54c97a-0312-5909-b5e5-756a7c3ab5e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:142bb617-0ffa-5718-8ed4-01c0a9e3996e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4f833dd3-9430-5e4a-9d1c-4d6f19ce98ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:09398c78-b8cf-59e6-836c-daf5b81072c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.12" } ] }