{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fd2d1763-3795-581d-ad5d-645ffeef3b69", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.3.37-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b486c17f-abf7-57f5-a6d7-301e0b6c6bdb", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2d14248f-4eb3-56d2-9f45-b1d64286709b", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b4ac0e1a-a5bf-5307-81af-b66dfdf65392", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:143c431f-5dc2-5961-bf8b-e484df26d5f0", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b8f31551-d027-51ca-b25f-5ad7152f1fe7", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:269cce55-45e1-5817-8179-2d58d4592157", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1f71125e-bce3-5ce0-a164-6c9683fedd64", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:79a51adf-9c91-5ddd-b6e2-d571e8a7100b", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4b11661d-1428-5bfc-a8ab-223e9fd45467", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:617bf62f-79e7-5c42-86f1-3945ae297216", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d5d0d53b-b1b0-504d-bfc2-c6f04a7b436d", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1ae415d0-6d77-5a9a-8322-008808500a71", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:336c0fd9-9307-5faa-9d08-7ff6ee7f020e", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d81e7859-9811-5578-a7f6-e9ea70c0b097", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:48897864-2f85-5d0f-9fad-a06001fa80d4", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2c80d34e-2079-55f5-a6a8-80f25d142ef6", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:733d889a-364f-5edb-b2b4-6bbb6981fb74", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7a507c29-7dfb-5e88-9240-184388f89bb8", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:20bc8aae-de16-5de5-b38f-d0f18ed1c38a", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-jcl. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a2645071-bc9f-5efe-824a-39474ae4785e", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5a767b63-09b1-5eed-bdc5-2406bea20d81", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4e0356dc-0c83-53ed-b01e-2112567e7869", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:26f70950-1198-5baf-af3b-be59a7e35274", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f1c2b69b-50cb-5153-91ae-c22ca62d0c94", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:86fd24d4-5fd3-5827-b830-8781ce512ae6", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9ad6ff5a-c789-5406-9fda-64e67792a2fc", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d795d28f-0955-5af9-82b9-aebd40e11fd3", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f6f39c7e-6426-5517-aecb-0a2ddf4c14d9", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-jcl. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8e38e9e7-17dc-5d44-bd09-1a9dc22a91d4", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:54586b41-8ce8-549b-858e-bd78f740fe3b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:073c515e-fa4d-5e23-8ced-b4ae2fe07123", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b86c9420-8ee4-54be-9d9d-9fe4dc081f57", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:567ea398-da41-5421-bf48-039f44edfe67", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:306cb6da-eebb-53dd-a96f-0cdfe35a2e38", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:22f8a96e-0b1b-5573-bf69-e1c185998da2", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4452d2a7-f5cd-5851-8108-7ae9048351e2", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:41689c37-d585-5bf5-8b76-e2ea524a9f73", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0dcc7771-c68b-5efb-b3bc-aa7a352dc6f0", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:094b2280-48bc-5b69-8eb9-c7ee514b9ee9", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:604c2be5-afaa-5af2-8c0e-7837e0f54a7a", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1825837e-3c15-5fde-8bd1-4027fbb30eb5", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:82850505-915a-5b23-bf6c-a6f50b16f9c4", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:95e11f1d-a173-553d-8273-5bec14327b72", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6e8de601-817c-5873-a1ee-c0a06e73868c", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ff17b70b-3e50-5bcc-8725-4f14c52f7fbd", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:93d79080-3fa8-5a73-beaf-078462c04252", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:19e76df4-86fc-5071-b4a6-09b2d6f24226", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.10 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.10" } ] }