{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6fddfb53-b69e-5278-a306-d1f37d6fa9f3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9b1e22b2-f963-52df-b0a4-76d7b4b6c85c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d747baa9-efd3-5d20-bd5b-a74262b24d06", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f10b391c-fa27-5843-b719-86848cad0a59", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:35fcab66-e28d-5e9f-a9a7-39b9a70068f4", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4cf2997e-1d9b-5e8e-9947-88c63ff45aeb", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f49c2d69-8d3d-514f-89aa-55a7047e744d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3e758069-9220-559a-9884-b81824f2c79e", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:042c9e33-1934-59f0-bd1e-c30db82142f7", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e156b503-a180-5c5e-850b-3037a58beff2", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:777a00af-2179-55c0-a29d-1df1abcecc05", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8ddc451d-8866-5dcc-b5a3-59dc481e61bb", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1d8acf32-2662-53e6-b266-a5c2d79e9013", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:26ed5886-a4d0-50ea-91d9-15bd737640d8", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:00e55dde-7fe5-55b0-8e4b-9b1dba649b6c", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d696d121-9fdb-5bd7-b2d8-0d056992b296", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0edd267f-4196-54a6-928b-13557c6ceaa5", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:cfee5040-c9fc-5e26-af89-25d371892ac8", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:26fd1bd8-d1a1-54c5-88d0-a29271a4e287", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f71a03ec-f274-58bc-bcf8-a7fc4bbdd76b", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:db5c2303-cd80-59f8-81fe-3f6e04d701e6", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5ea8fa8c-4b0c-5e95-8ce8-7bbc2cae51f2", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:91464777-cf2c-5d27-b04f-34326ebb13ee", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:882e283c-aa01-596c-bfe5-03674ca033a2", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0ab9be52-8426-59c4-a166-78980a69a953", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8c5fd1ec-b9fb-5299-bb74-f19c58523d22", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e4ccbdd4-deb3-5f05-9832-56b12272f77e", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e8a8ec7a-dd81-54ea-aefd-ae6680bdc1f8", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ce1094cb-37dc-5a0a-a181-6a26d2644191", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-web. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f9d12c4a-36fb-5ff4-b138-839efe883a19", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1d8e847a-b436-5f02-bac0-4df7291e0d4a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f9aae45d-58f5-570c-bfbb-4f3402960802", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7f0ff35a-959d-59e3-b80e-cdcb2c439f4c", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0c4778fc-25b9-5655-8245-7e19e0ec2d50", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:41b960bf-ec70-5501-b267-533a0431b059", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d3a896aa-66c6-57d9-8d61-ea4fb23d97ea", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e9a62900-13d0-5110-9986-ab71d18622eb", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:99a4bee5-608f-5b73-b954-ff7a42fc02c4", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:361e27f8-d290-5295-94b4-63870f080114", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d9fc2266-3090-5256-94f1-60ae97efade3", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7c7df077-46e8-538a-8a46-6665541e2e09", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c699fa73-4081-521d-a50f-417f4fcd83b1", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:bd450869-2879-506d-8e0a-f95d1e19b22b", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5347b94d-ad30-5868-8b15-753c5106feb3", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:afc8cbdf-bceb-569e-8f21-43ca5c3e4981", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:27c55c51-8c2c-58d0-b9dc-75a145280d21", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8d567296-3296-55a1-89fc-cec2be072205", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5282218c-f92d-5d36-ad3a-3bcc0dc5f5a1", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.11" } ] }