{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3d003062-0d1e-5703-bbf0-365b27dcfc26", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d7a68b5f-8156-53e9-91bc-a4c6692d32d9", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:66032249-0364-5139-a480-160a022b7e91", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:86b494eb-3f98-5ac2-93a1-cda13c4b63e3", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:633912eb-808f-5781-b63e-98b1bb517d02", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e65ed086-3aab-5839-a603-918a9b73f520", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ee0fb2cd-6fcb-5ad9-b900-295ba9eb49aa", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9bf45a35-2b48-55a3-8895-c7be2e07e288", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0e319139-34f3-5bab-b771-452bbf8184da", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:cf2dad2a-983b-56d1-afb0-0b31a0132765", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b4015583-c4fb-5169-a741-bdc6f1889866", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a6bb8e8d-90fd-5140-bd11-0b8082de7812", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1a1cca9b-1833-52bd-b73a-bc6b89af9dcf", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f0ac3721-0d45-51f9-93c9-3c61c613add0", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:25fc0206-2c2f-5d2c-93a6-015d1cea9797", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:248c7732-e5b2-532e-b975-d806f42ffb10", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7e7ca290-e99f-5a75-a0cf-baf288627f38", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b4ca040d-d92c-579f-b47b-238dcc5247ae", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:51b3a58d-35b2-5e1a-acb5-b7eff1ffa3db", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7d2ab065-2dcd-5cd3-bdf1-c86b2f8e1be3", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:168903aa-91ae-5936-8fe7-b02cc6b8c3d2", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a91e58c2-6302-56fc-a9fa-30bf06621a77", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9472b072-e20b-5221-90bc-58cee2185589", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:10b85116-1c5d-5d20-8789-86de1c7634fe", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e3835822-b353-5825-9b42-757d0e721093", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:cc1160ea-8172-5ee9-8c56-b44fa17e1fb1", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:dba03afc-c257-5d52-b1e6-d0efb0d7b134", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:47346de6-e8ec-5585-85bb-0db63634b91a", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2ba977d3-1047-5585-83f8-94d2b467bd1f", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e17587ed-f3d7-59ad-9dc9-828207aa775b", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3e52fb8f-bb72-5316-b789-1269a0dbbf1b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2bb944d5-03ae-5d40-b38d-ab159728d813", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0b274fe0-d74a-5339-bd10-f0ea592c165f", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7f0aae83-d2f5-52ee-94d8-b2e610cd15c5", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-test. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:87a2924d-aed3-535e-86b0-f7390dee287b", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6a135d30-278c-588e-8a0c-79f51ee37474", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f90fe62a-fcd4-5333-9708-f76d0dfa3322", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9012eb5c-1e7d-5086-852a-705c28787a93", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2a43d397-ec84-586c-a527-a53d28df1a26", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e3d5b127-7ede-548e-8599-799de7a8f214", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:656bee70-6517-5870-8484-6e7f77735ea1", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ba9265b8-8dbc-5769-b258-5a9ffe3a555a", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b3f6a780-df1b-53ae-83df-ea3a8b949dd2", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9f319b4f-62a4-5666-9144-aea970a1baff", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f735dfb0-45ba-50a6-9ad1-74c590112059", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5d5a31e2-5513-52e6-b2be-db06a7f8a2bd", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:034962d9-e020-5429-8bb6-1c33186ad53e", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:92b89b2d-f753-5e28-9d31-30daad8bce72", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.11" } ] }