{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1bb3e053-2736-5d7a-a60e-a47c269b0ad6", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-aspects", "version": "5.3.37-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:662453a8-5977-54c0-aff7-bc9427adc4ac", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7d666766-bd69-5a66-8c09-2eb41138be87", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1efe2719-42ee-55d9-b4b9-8ad952291c19", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8765c51b-d9d9-57f1-b294-3c8f41118513", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fddcd58d-5413-5147-a44e-1cb76202c198", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6336a306-0078-593a-9d8b-46c87b40278e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c523e7a1-155e-5091-8766-d83028180a0f", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:71a993d0-9f9a-5777-a058-a1e40ad491e9", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:411eafa2-09b0-5de4-9b3f-901ed9c4fc8b", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:cb06f235-cb73-55d2-b9c9-951f2d978fc6", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2b3f9bf4-f17d-5298-9bb4-680a49446389", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6a60b38b-418b-5116-85f9-613077c5e3b7", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2db26e65-18a2-59eb-8152-a293ce78f230", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:23c3e670-276d-5729-9559-0b96dd2ace16", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:404ccf00-37f4-5e28-9531-a84f8ff31092", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5d6a8cde-616f-556e-a49a-8e927ce437fc", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b7eee58b-2499-5984-9c37-1204686b86f8", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ee9b87bc-6cbe-59f8-8d9e-b9b400411159", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9131271b-037b-54a2-8a51-a1bbc5fde300", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-aspects. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:12bcad96-2b02-5287-9889-25a11a6d94ad", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:17c9c928-f921-51c0-b4a0-d87c7408fae7", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c447f846-3c4b-53dc-abcd-69e38976bfae", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6506963a-2713-5898-8baf-3c6467f15409", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b63ab2f2-aacf-58dc-baea-ed238e32ec52", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4862039a-f0a6-5598-81f3-4b647c7d1e0e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:49f1713f-3417-5ee0-a6a4-30022590df1a", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:12e3233c-a84a-55b4-a692-633c77566784", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ba28b59b-f858-541d-986f-51cd21a6bf55", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-aspects. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d8206109-c4d7-530e-89a9-91f2c97b1998", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1591f303-9f27-548e-88bd-7db354ad8e69", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e78a2ca3-5ff5-560c-97f7-def35cdace28", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ac7983d1-60c6-56b7-91c7-9bbe1ed543cf", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7569653f-a25e-5ff4-9ace-80c69df5bd38", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b57f4d2f-1d2d-5614-b27b-1abdc01fcfd8", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bce64c4a-8493-5fb2-a984-d966f953ca15", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f454861a-fc08-5982-afc5-8f12312b36af", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1836c4c6-eb93-5c0b-8e9d-1f8b7e04f216", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e5410f42-2293-51a6-9b73-7c2dbcdc4d1a", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ef10e564-8b37-54b1-a336-b7ea766fc3ae", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e9d017e5-cb1d-5fe6-aa23-c6eb19a8d621", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7f9cd3dd-a764-52ec-83c5-33ee8e7b7ba0", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:502f0ab3-5262-5a84-a913-1958d1c75428", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:750a789f-5fbc-599a-9754-4193cd23b1c2", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:59247cbb-fce6-5dba-963d-a233ae309b13", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:999794c4-39a6-505a-9b3c-6fabbee704ae", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8d0c6ceb-1e03-57e1-9db8-d0ae442ca39f", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b298fbfe-deb1-5313-9c33-7e6bd293edcf", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.10 of org.springframework:spring-aspects." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.10" } ] }