{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e69e57da-a1b2-53ae-b95e-69de8cd0484c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-jcl", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ea8791a5-7cfe-5030-920a-4bd1437bc2c3", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e1b69585-dff6-5031-918a-dbd6560d896b", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:83fb6358-813d-5c8a-af27-697f6955cb90", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3b96800b-1dc6-5eb6-b39f-550e5c6cb19f", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a3c40658-0a48-5ef2-bbc9-93bbe03b1329", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2ed5f9a6-dea4-5c32-94f2-27167974c767", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7e357f55-d438-5175-8a0e-bc729083e8e4", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d2cf2574-c8e2-5120-b2c8-539c84a2342a", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:926f0eec-9986-53d7-910a-79ad4aae4059", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:83b55e6b-1db2-578b-88cc-41e40a1ed777", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ea0392cd-8e89-5621-92b1-e99ba486170e", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:003cf75b-473e-5f90-92d0-a20b99e3f31e", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ace32fc8-a4b1-5022-a4e4-125d15284263", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:acae5c93-5f0f-502b-b8b2-fdae7f318a22", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7dd8746e-712a-546d-acc7-555a380bb320", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0ca396fb-216a-5147-9b76-fc44efc324c5", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7016912b-a182-5334-9f44-047604a48277", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:701205da-b603-586d-8c2e-67cac11da161", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7b936e88-3834-55c2-b1eb-0d1804b97fe6", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-jcl. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ea067a64-7704-5740-ad87-f10423837d18", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:34a95895-346a-5678-90c2-91ab24a34f43", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:964b59e8-3050-50f8-8bdd-d30df792452d", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:41d344b6-245a-5d95-9bbe-222e84e8add1", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:67172f7d-e943-555f-9771-9597a7dc071a", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3df6d388-f2ff-56fa-b572-7acc34c5a89e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4f0c68f2-9492-5419-bbb8-c5a6e7cd8b4e", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:81e17ed1-2b93-5c3c-9034-aa0def47e015", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9281c4da-7e72-5a1e-802a-21858bba06ac", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-jcl. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:444d725e-9755-5b01-baac-de6322ac68ff", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ee87320b-2e01-5714-9aef-6229accbb7e8", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ded29cdd-285f-5044-98e6-953b6ae1464e", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6ab69805-eaa1-533c-9e29-eb7d932ac271", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b995bac3-3765-5aae-8199-1da7b905e813", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b4314be7-145c-5ac3-b4d9-28347f304d5b", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0e1d0967-3990-5ff8-9c6f-99f22e8a3d1f", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b1ddef21-3c27-5bf8-baf9-499a57ec995f", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:67b3f234-8481-5d94-a638-1ae149183607", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0448a158-7519-5172-9228-a0cd63dd6f22", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1c78def4-74ee-5d00-8c60-1de11ef77f4d", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c1dc798d-2027-5d84-abd4-5f52a1269002", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9262d5b5-5c11-5f55-b7bd-9efc4fd8a1ba", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0de7b4fe-6612-58bc-8fec-36756ec2f7dd", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8654ff91-7ef8-57c7-b5d7-c84dfc00f97b", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2fb932c4-e560-5bb8-927b-4ad86f778d94", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:08535b24-fe0f-5b2d-ae32-2e6fc5c1de59", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b7809319-9757-5369-a242-15a41ea4e282", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1c11d481-29a6-504b-8af9-f19186089dc0", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-jcl." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.3.37-tuxcare.11" } ] }