{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f5243bfb-3c3a-5d56-b4ea-50369c0f2b52", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-context", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1b4d0747-76ab-58d7-9672-942040022208", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0d216fd7-4ac8-599e-9bcf-b1f152897c2d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:87783960-8841-58e1-9872-239310b24342", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:bd13e867-f54b-51c3-8cad-092c4e981013", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:31ed6177-b57a-54b1-b998-e59fa878a432", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b3869f52-d65e-59f8-a358-2c2a5357e775", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ca3399d4-c346-5af1-84e3-eb7513c3011c", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2dba748d-5993-5126-8030-ec7ef5e804c7", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:01ab2701-88ef-5465-a3f2-c3b46b15c91e", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:74d61b4a-9133-5114-85ab-4f6d6e6d09b2", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:90f1f0a7-c755-5e00-a461-a857f2bbd220", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9efab8dc-f914-5191-a2bf-462608aee5f5", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:68f9b46e-3d1d-5e94-a3ff-12725832dda8", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:29067ff1-e1eb-56e9-a334-f78defad61d6", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:42852893-84e0-51ca-9de4-f2b42d133392", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f6179f6a-ecfb-57ba-89c9-409dec49449a", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:30020ca8-811d-50c5-aab7-3ac2f08676d3", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a9398794-59fb-5316-9b3d-be3e9553ea59", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:26d1e023-ddc6-538c-8642-c24fbc13e5a1", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-context. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d8fbcca3-526a-5eac-bd4f-24c27c301dab", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6b3cc0e7-65e2-5a0c-8058-00ae0165b417", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d452447b-64fe-514e-b726-2365c5845280", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e1761b98-d76a-51ee-85c5-4323393659ff", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:eb56f81f-1e00-543f-ba56-07e08dd8ea96", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2825eaf5-466f-5e98-ba6c-1341387e5e67", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9b6b1758-22e9-5f6f-9888-ebd366ea1031", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5b47946c-7f54-532c-8eb8-30c13f0caaba", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f9cee893-d574-5414-8e4f-fca9a1e6242f", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-context. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:68895fcd-c443-593c-bd0f-6a7c1593ba70", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:719b55e0-0f88-5a60-b37e-5a2f82dc0365", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:eed38c81-4757-518d-92bc-7c9a2ac20e8d", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fe2cb7ee-1a95-5f94-a83d-751b16a2fa65", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2eb76c44-9633-55c4-8a44-967ecf4a5e4a", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-context. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:754bcba8-3b89-51df-8353-e2293196f840", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ae3d6b47-02cb-56f8-935d-a8665215e18d", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:eec9b8ff-fd1c-51c0-88ae-d8c3b6130e4b", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:889b7002-5c09-59b3-945f-23cca840d241", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f651ffd0-4375-5638-a2c1-e1b55326e911", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a6db6871-625c-5b2e-b0b7-04753f3fbe73", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2afca97d-25fb-57bb-b398-009c7c4a2864", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3ced720b-5433-5b4d-a5d5-5c6b3e304ad2", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:39224a22-342b-50b6-82d8-a5eb96a79b25", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a6b7c369-29de-5e27-b585-3eb74531e066", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:203838f8-a641-514d-9bb3-df89423f299c", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:cc369739-6b0a-56df-8bb1-baaac65eaea6", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:03166849-8dca-57d7-bd0d-f06f6c4550d5", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ea759f88-c2b0-556a-ae69-36f146c3110d", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-context." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.11" } ] }