{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c6cb053d-7f3f-5c42-afde-aec86143b9c5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "5.3.37-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:388b01d6-67d5-55fd-b472-b95c8c1f02dd", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0b7a284b-dc6b-5d96-bb7b-b2101e6bcb8d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:795d82e5-11ce-5e18-8d3c-2fb37e3b03b6", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:30715ea9-b0ea-5073-9594-44e97432348d", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a74d601f-b8fd-5b34-b6ed-59677eb2bd5b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d0f024eb-24cd-52d9-a03c-4298d923a7ad", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3e1a92bf-ad6a-5f6e-b0c2-08e282ee8073", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:653e1d8a-33ae-5438-825a-b64899a7ad56", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8d3dc935-2f4a-5ac9-a872-630b0b619d38", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ee05c84b-b307-53bf-a512-8b278fe73c0b", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:20e4a59f-c3b7-5654-b272-a696dde46384", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7406b983-226a-5b48-9906-c2b1cc6d2816", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:75b73d69-5b98-504f-921d-4a0448c24bab", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9849bcb5-2194-57a6-b18c-f608b1ccfd5c", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:347726ea-61ce-502d-be65-82f527502d05", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:25777b4f-f78c-5ccf-a736-9f5b28dcf70b", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0461fcd1-95f9-5f9c-ac98-91e1090c4051", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6247f652-8964-544c-8eb3-1ac780eb6db4", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5b95538c-213a-5981-b6e8-f80cafc14be3", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:93f68dee-792d-5cb4-846b-0b8da2d48172", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:19590d4a-7f40-588d-8e55-6ef2cf849aee", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:80a1d470-b5c8-59aa-9019-02b563dc033d", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c539d388-3c6b-5b0a-80fb-937aaa458aab", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c4522317-42d6-58ca-8a65-ebc8b8b4e063", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:368c65ba-640e-54f1-ba50-29c0ca4de8fe", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5f4c76fc-6957-59a3-9ed5-a02141ad8417", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:14e0087e-9db9-5e3d-9fe2-dd2cc404c7b1", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fee4e30d-97f8-585c-a7a2-b891aabca410", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6d8b64c4-a256-5522-afa6-9b992c1e7640", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2eae97e6-177a-5c40-8017-0af499e27e20", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8ca76c10-fa6d-57b0-aff1-db625ea24df4", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e7e77a95-4f7d-58e6-879b-f7056b8becd3", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:edc4c14e-f9f9-5b2b-90a8-33d9401afc9d", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-test. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:74a57906-9081-5296-933e-61bfbddc3d08", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:42bc459b-9f1e-5642-834f-51a959108426", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1c25fa29-3fb0-5f66-ac01-b86cea518eff", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0438565f-4d52-5128-af51-cb3baf330fd7", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a2d03e76-9972-5875-9414-c9ef0369ad7b", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:903b0577-95e6-58c3-9f3e-f0af18655dce", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e145a0a7-6e8c-5843-81d2-7eb0f25ffd7b", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:89f1dafd-2d3e-52ec-8be1-e0613114737a", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b57a742d-c30e-50ea-bbb1-17328df38bc1", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b1be8f0a-aa1b-56f0-8e8a-80c9320f7a46", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bcfa32af-00fc-5df4-bc1c-ae7d501d3800", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7b13ab45-247c-55e4-84e9-5d964fb5d233", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:43d6e5b0-4c76-5fff-bc52-17964bb331cf", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e9d1a975-49a1-500a-8eee-d52c6d1d60a6", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.10 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.10" } ] }