{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e00471ab-1cd3-5137-ac8c-9c800f3d7916", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2d6d0e99-adb5-5064-9bdb-b1f290e3d682", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-aop and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7f7161e0-d6b7-52d1-b2ba-6020cf3ff4c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:47f5b2ea-b38e-5292-b8b2-88b1f58c75ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dba5ff5a-633b-52b9-aae4-57647adf2161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3ae3f9da-d944-5952-84c2-3c7adc3f6fc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4beb6929-acb2-5e7b-852e-151092e0dbe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c0b5495d-e8ac-5111-b7c4-5269f743d376", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9189f55e-fdc8-5cb5-9203-79bb8b5e6cd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:335703cd-bf38-5a85-b699-3c72d2aab7eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dfaef3b2-15e9-542a-ba73-27cb28b710e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5d6c619f-34d3-5d83-9617-0107ebb9cfc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2efcb4ba-9fa1-5963-8ddb-ff8c68894356", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:df8b3edd-92ed-5dd2-93cc-be11f39c32d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:824652e9-b657-549b-815a-4529e6163f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:de40494e-a8e0-5b6a-865b-0646d6d254b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2e7a8b9c-4e65-5add-80ea-055a85598d30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3e1333dc-3044-5f87-b5be-b6a3ec7c89fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3faa9566-d201-5182-8a0b-fc32fc76b8ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6dafa486-5ccf-5521-ae3d-b2c9a9564c2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aop. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c82e2786-0325-5a85-a67c-4786c1153465", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5e5e5ddb-f78a-526a-a1a6-c2c610623de2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4ba811e0-e3b2-5767-b23f-4af1a775f1e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e27e5c7a-153b-506a-93f5-59144a4241bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7941a827-8a57-5621-afea-cf5cc6511632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:88b344b8-cbad-51d1-a0d8-f1f9f9ea0f78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ef5a1586-cfcd-5eb7-a507-982652649ede", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cb323d0c-cab8-56ed-a68a-f5a65f710a74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:60487aac-a3cd-5185-b436-a2105d08cc88", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aop. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:35065b5f-3fb3-5703-8486-92ece5095140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7f9966af-e0e0-5ffb-abe0-d3efc6af8c6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b74b0cde-7d57-57ac-9f0c-05f362cdbe50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4294edce-053a-5d78-b63b-2e223cc7f341", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3a31f20c-ec3c-5a25-b4fc-791f16986649", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:547a14e3-5e91-563d-93e0-6e62a9e98ef0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c0f77c98-f3a8-552e-bba7-9d960fd02bb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:25bd09b8-f174-543a-90c0-eebb9b8864f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:35b715a2-b4ff-51f5-935c-ab2258ae8431", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7324b2fb-e1d0-50f3-a1e9-086a1b3d56d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0e80fe01-c5cd-5a50-bf74-39e6c0b6b511", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aop. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e7e41369-5b9b-5661-858c-b3057e5e609b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:917c59b0-6e20-51ef-ad90-c74277f4ee94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9d210aae-b6ef-5522-8ec4-e16c3993324a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a3de0092-cf23-5c7e-a563-fa7de3c0b62d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8a32fdc4-e2da-59cc-9d73-20a391fb7029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d81ee4c4-912c-5628-bd81-833db85f0bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e9a6202f-e979-5a0c-9199-744488ab05f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a264e4d5-780d-5fa8-9834-cabce74e26c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d678e6e6-ba45-5bf8-b4f2-29a0cc9b5f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.13" } ] }