{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:77328305-f4eb-52a1-abc4-23ddbc2040e7", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-context-indexer", "version": "5.3.37-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9dce3e9b-902b-5002-a096-0034dc769ec8", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2727e104-1917-5e6f-8b61-293f1bd29174", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9547865-86cc-5b30-9164-e0f9f0bcf372", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a737082-b9a5-51b4-b405-e68fbda20765", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3c9f6887-5361-5c50-9a58-979831a84161", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a9f4e9b2-9b64-5c51-aaa9-bfd9928ba862", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7ade2ac0-a2b7-5385-9437-85b6b126ccea", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ad535166-845f-5d43-ae09-ba19381b15ac", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:26c88d84-40f5-5de6-af55-c13ee984e3f4", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fa898717-5bfd-5dfd-961c-16a83e4b0b65", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e09569b2-6103-57cc-a087-1b0a7c6ab074", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b8580346-eeca-5a9a-8ef6-241db1384520", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5319095c-0428-59c2-b70c-ce7b036c85e0", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6b5f717b-8e0e-5e5f-974d-db05cb5fd4a6", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4b73e3ff-af39-5146-b963-bee97533f493", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4f4fd0a7-01d0-5f8f-bee6-25a9267bd725", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:28487dd7-f219-5b35-b958-f1430296dbb4", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:183f7c18-d5d5-53c1-9337-f455d94827e6", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:77497bff-2dee-5c7e-8cc8-8f5b5d2ec534", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eaaaf7a7-451d-5534-a1c0-79cbbad0994b", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cf301d93-31ef-5640-b4a1-3f29da618993", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f0baa7a9-3f3f-55c8-8ece-f7af673da9f0", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a69500dd-62cb-5bbd-ac1f-0364b7a02f50", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5d6bed0e-fd05-58f6-a4f4-abeaf932b639", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:993ea7b2-fc15-53d5-8f8f-0c8aabb5fa09", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8db8f86d-360a-5610-af61-56e5ec8a8410", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2718da62-495d-548b-a74a-80b2d56c5e64", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a535f5c6-fef6-59b4-88e4-f0655a8d0de4", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4181e512-20b1-5fa3-a894-da6756df08c3", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:481cc3d5-2e4d-53cd-9a37-08e41b72e1d8", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b13fa829-67b2-5842-9a40-d7b88a4c5d62", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:23ba0e79-2570-5ce9-aaf7-1ecb4ae11aff", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b8a70247-a94c-5779-a3b2-2878d361718a", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0f93e28c-0f93-50fc-8dd4-1d4c48cd1960", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:436c5bdb-475f-5826-85a0-25fec8f245ee", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6c9cc451-e31c-5a98-ad94-9fbf35aad2e8", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:28fd781c-3f87-535c-8ec1-e81c1c2ee469", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c8ba92d0-b9ce-567e-b32a-b22d7708ab38", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a67f12ce-e24d-5e7e-a21a-015742d693dd", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bf1c174e-58d8-5ace-bb48-24032ab45bf2", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3e0db260-4195-5152-98ea-c6ec54267963", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:928d2c11-2a15-50f7-aa9f-2f65c99daabc", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:234d171b-1d1a-58bb-9815-e16d678a7843", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f099f5a1-a9d4-56a3-9420-3e6a7c3fe42b", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f9f8ac5b-3e56-5ab2-aa86-71044075d044", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2cd2a490-6414-53c8-a4c6-edb6bc985189", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fa55edde-658b-59a1-a62d-c578844911cf", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.4 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.4" } ] }