{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c5f8d72c-7bf7-51ea-851c-33e6a38b00d8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-beans", "version": "5.3.37-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d3d2475f-a4dc-503e-960b-28af7c0f9bc3", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cfc69e7b-298b-52eb-b032-735c35aa8f93", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f2498b57-a782-51a5-83cf-018bd1865874", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9ba9ad9e-2d37-5f58-af84-b7b84ff18101", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:46455b4a-2bd0-521e-b219-6d00057d50d5", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c1b364d5-a539-5e81-ab8f-c8ef7148666b", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:875a60d0-8b9a-571b-acfb-b1008aeedeac", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8d040e77-4359-565e-9f25-612f91473279", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dcaf7926-d89d-59fb-b06f-6cb06579b725", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cb70dce8-006d-55f4-bf6c-6b8c5d80797f", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b80a3cdf-b0b2-53bc-bef5-55c0d7056751", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8edac3c1-d552-53a8-afaf-4595fc3188ad", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a3f4a4bd-20c8-595c-b336-dfbc94c84f5a", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a62f0717-5c91-5992-a809-402de517640f", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1ad4b046-17c9-59cb-ae30-5988949b4c08", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:86d7bc3a-32f6-5259-816d-56ba622cf955", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:01bfbeaf-a169-5de6-a2c1-cb2d91914b94", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:97b19d52-3dc8-53c2-906d-f75161d58fbf", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7c5ad1e-d549-55d1-ab95-6cfb557348c6", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.5 of org.springframework:spring-beans. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a8e493e-6efc-5c0a-80de-2ef4d524a11b", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b1da4810-10b2-582f-8ac2-55846951d65f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a3d9d5e-45a3-5a8e-bbee-0e0237a59ace", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a495a2b7-8568-5bed-b184-637e63d9ad1c", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fbef0c5f-4071-5c8b-96fd-67061bdb156b", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0782bdf7-80e6-56ab-930a-a2a0a90e8d82", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7a629b1a-a2ec-59d1-9192-50b109478bcb", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1cd09ab9-3eff-5a47-bf44-c44f8c232a9a", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1fb462fd-f9e6-5438-a561-7740c2ab0521", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.5 of org.springframework:spring-beans. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:79c586f8-5302-518d-aba1-7eb76bf59fb6", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d1bbb312-396f-5667-ab5c-cd0b2ccacc5f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5ad0a275-6ade-5e06-b952-91a20fe39e2c", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:808d755e-7f6c-5b3b-911d-0da1b6dc944d", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:83490876-c4dc-5a5b-918f-6c9768b00d1b", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.5 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1442032c-384a-5eed-922b-ba5f450fece7", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:67482e9d-cf5b-52a2-8b62-e929ffd30d80", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4986c713-af07-524b-a65d-c10c474bd4ce", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2fe2665e-fecb-5fdc-9f67-c9a3d7d267bc", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:15d1c3f8-4f20-5c96-a382-06dbc809b5fc", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:857455d0-b266-5502-984f-36aae5f73d48", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0abd1e73-450e-571d-8adc-4bf42e2bec87", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:edc38fe1-dc4d-5033-a64c-013af1899846", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:14d3e2e7-73b2-5e6d-9e42-3cdd30d6af0d", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3e9cc1f9-5ef5-5fa1-9d1a-20c5cab7356d", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:32396758-2580-5528-8b59-89b1dbbc5672", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:56942afb-efc6-56d5-a46b-5e61f0bef712", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0d6c39a0-9d81-55c2-bea8-29c4a694dba6", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:74d09141-41bc-52b4-87e1-1bd59d1f7fba", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.5 of org.springframework:spring-beans." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.3.37-tuxcare.5" } ] }