{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8acf1948-c0a9-545d-a842-7c6cc54b2628", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-context-indexer", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8fdbc349-82f1-5cb0-a344-ffa1da0a1529", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d45781e1-9d75-5b80-812d-321c8cb5efb2", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:da72fec2-e838-5c06-8c93-098746d26d76", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:77a2ad45-9e18-525e-a455-80ee50c3ae6d", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:318e4aed-730e-5de2-88b2-b3b74cde9a8f", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9de61bb5-b8d2-5a3b-9859-478bb87a3570", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8ea76807-4227-5bcf-8516-1e60da863a10", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5e9cf117-fe0c-5a89-b530-8bf9d9f99760", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b38962b5-3602-59b3-b1d6-eb4e72abb647", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0adb52b6-a492-5194-aa1d-f8c4fce27d10", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c571e250-6d85-59d3-9f1a-22f0cd2ce093", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:eb5195ed-4970-584f-b2f2-7e24d511826d", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:49ba334c-1afb-51eb-ac9a-368934faa77a", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:94c0aef9-9be0-55a0-ae6a-c11a35b5f306", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4c11855b-be8c-54e8-ba4a-9a2359dcae57", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:bce3c75f-0052-546f-a51a-0d7d007ab5f1", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8b7b1dc9-e91a-52a4-9003-5dff13480604", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b43a2d3e-3593-5584-a4e2-9a8ccad52d90", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e0fbad1a-0385-539d-a925-ef1754f85f29", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:72f92f26-4fdd-5418-bd78-dc43edef9386", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5bbc9b69-1843-5a4f-964a-f7cb8badc0bd", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c36eb62b-0daa-50ab-bcba-e41a771bfa82", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6d3dfc71-3f97-5856-af3b-8ab984fcfbce", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:20cd68eb-d108-54bd-84ca-cadac9f760a2", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6a4f6a3d-5f3c-5e6e-9000-060a3f0fe08b", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7a3ec7c1-6209-5168-b4f9-ab5697adc679", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c82ae5f6-6031-5ff7-806f-02f1ea96b225", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:05849740-ecea-5fb8-ab05-e43de5ccf8ed", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:dcd23f35-1050-5124-afc5-258bf38b22c1", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fff6ed05-37b2-5c5a-95d2-68a78ed77153", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e8fde506-d209-50b7-9fa6-7730210206f1", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d8abe620-fff7-5b75-a238-78b2ea1f5e92", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:005d3360-86f3-596f-b745-119bf19db473", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c721d746-6af5-59e4-a12b-3d1a1bdf06d7", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0261f21f-e80d-591a-a813-7b6f15381161", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b51f5118-932a-5659-8b43-15622e165935", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d084b764-a4cd-58e7-aa27-d04e3f2f411b", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0ddabbdc-f587-5365-8bf8-84156c01953a", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6e5f72d6-af07-5288-b217-e1c3ddefe523", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0711862a-e63a-5d1f-9254-c93283d05407", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e1834298-ca16-5061-84eb-10f7bc69da1d", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fd8c5794-c804-50e0-a985-7ce0febe9616", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5e13c81c-f660-5a56-b51d-9aa13275d906", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:14cbe010-c7e1-59ed-a8e4-1230fbe6b932", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0be27780-ea81-54df-8f0f-14acb1228f9a", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:95a36789-5ad4-5c83-9df1-429f94004adc", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:468dd6b5-9b7b-512c-bc65-bd562fcaefe0", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.11" } ] }