{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ed48842b-618d-524c-b22e-ef6e7b5a61b5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:786047ae-47ad-5b29-a528-c5ed973e6f6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-aspects and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:87f1984a-955c-5780-b730-ec5a8235a5bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3308ff68-d2bb-56b7-a49b-305fd5a2fc51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d4d1bd29-58b9-59e8-9210-8bc76ef0ddaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:086122ba-a410-520b-b04f-86516a9f117b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2032bf02-c3c1-5840-928e-4eec09ec7c93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:684244a8-c2e7-5ccd-85cf-8d8c997e886b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a8639d27-5435-5bd7-aa2d-4321ea54e121", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bf018bc7-536b-500b-95d3-f21f14025282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a0303571-eae1-50f5-a762-02fd1522b490", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:49288dce-864d-5c99-b802-3033cc800c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:79ddb99a-f058-5538-9827-fd49899807ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:778e8f12-41e5-59d9-a5e5-698e8f225eab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9ebf944d-ec3d-5078-94bc-ff3fa165cc79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:13509201-316a-5c3c-86c0-706d1343c9df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f841f860-17d9-5901-8ebf-9bb3386be8a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9f5671e5-b13a-5d9d-80d9-e666db56ddb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:511aeb1a-c363-51ea-b01a-81bef9aac263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dcb2a056-c461-5f0b-ac90-7cc2a00e8fd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aspects. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2ddd8ca9-0dd4-5959-905c-a3ad9ea05091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e1083cb9-7eb0-5523-b3d7-2026e3c4121b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a69118eb-3914-59f2-b3ed-b16969c8b017", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:72e41db7-77c5-502b-baa2-3108fa990a03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:70be788e-02e6-582b-93dc-c1b6068603b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cbfac1cb-9fde-5558-a037-55af3f33412c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:739b2465-0bdb-598c-a350-077fdd85a878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c245fb7c-13ae-5580-8319-2d17f2f1b287", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:afcc3697-d82c-5f5a-994a-bd76c3231127", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aspects. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4dd2bd63-2fb9-5993-8900-39eec5c36b8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:db24f1d4-9ce9-5bd9-93f8-491c07e846e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a93d5da0-54a1-5858-a5bc-4416366f0f0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a238559b-9851-5df3-8e13-17bb01dded48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:13c0678f-4362-5b04-abb6-93f391930a1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:60cc236a-a085-55f0-8807-d6f4d1da8f12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:db96d1d7-50a0-55cb-aa84-16999cd68191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:58c49b85-c813-5a54-a9db-2a30a0dfbea4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1a1493ab-0efb-53df-b53a-3c727335a7cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2323ed95-2609-5a1d-b890-9d94a6079350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9fd619eb-2159-5a93-ae69-20d2ede49a7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-aspects. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5389a78e-7bfd-5bea-b80b-8fff54313e87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fa68379a-10c6-5867-b91b-8a61d6cd6b1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fc42c3fa-6828-5f9d-8f4e-6d5d1c3c699e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:82f28290-3836-58c5-a50f-7758d7ddf72a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:39056980-94e4-5d34-9aa5-c0bceb16d0f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a07c9943-d817-5bd7-bb5d-6e9c93b85e00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3bbb41ac-cc18-57b8-91d8-68b984e3d0b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9f7ae9a2-ce4d-59ae-9e62-64f108890230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:06e3f7fe-6fa9-571d-9097-3592ddafb1df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-aspects." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.13" } ] }