{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5ed6893e-7aee-5e21-bfa7-9bcbc2773495", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-context-support", "version": "5.3.37-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:27941f05-4048-54f3-a21e-bf7c6d043f31", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:726486bd-e170-509b-aa7c-b74e48b9a391", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7ac2d58b-14bb-56c2-a169-53fbf51b10a8", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cdfa7b0f-d3b1-555c-beee-a7d1eef0852c", "id": "CVE-2024-38816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:82d83b19-bbcd-505a-b40b-4e1b133cd12c", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3a8eb159-1d6e-5d62-96d4-45377056ceb5", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c6576cef-5d56-5003-be3b-5306a38ee1e9", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:834e5fa0-ebec-5232-80ad-84f1a8340503", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:60332bdc-aa95-5aed-8728-e1f2c9900ca7", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e351cedb-cb79-5fdf-aec2-dce56fa9d466", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fe8f3ae3-d803-5bdd-bf4a-df8e02f6cacb", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a3132be-8de4-56a5-a7a1-15a32d6bb5a1", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dce0b781-36bd-5b96-a66f-05303c70060e", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0aa420df-fb3e-5dc6-b913-4f3d44fd281e", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76ab80bd-4c37-5965-90a1-18f6d84d1cfa", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8ea10e9-f520-5dae-85a4-1120f29aec8b", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bf8eb57b-51a1-5f2d-ae1d-08d12a97b3e4", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:53c53626-02ea-5d42-8e3d-cbae8099ce63", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d1626e61-6a8a-5c80-a4ec-e10b38239ec8", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-context-support. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f38f9b01-e390-5143-9fa5-c9af0ac33963", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:844e009c-8efe-5b51-85ff-ae1f73296bed", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b2ccf85c-b842-554c-b19e-63181588dd82", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1881071e-8b7e-589a-98f6-eecb9fd9e9a4", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1bd78141-5517-5c75-a346-c1f3a9fd54fa", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:acde8a4c-efd3-59c4-a2ce-c2e278a06cb7", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e322a0af-76a0-561e-af71-9094c4836424", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2da95609-6418-5386-90c2-c9ae8b80b96e", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d3fed2d-81e6-515c-9a30-c626ee30947c", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-context-support. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7810b8b3-baf3-5fb4-8092-069915e23caf", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cd0950f1-7cb2-596d-b061-41aade33fdb7", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:54d40a03-118d-5ff3-a13e-11a4dcb61537", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f9993e69-6e7a-5fe4-aa19-56bf6d9e22b9", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8589b627-d767-5915-9399-c7b9d0de6f63", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:259d1f12-34bd-5af9-80e6-f3d9b5f3d934", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f2289787-ac49-5ebf-88d3-b0c33ddbb5ce", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8c94f747-9919-59e6-a31c-57f45e757b3c", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:665ce2a4-d939-5d4b-815e-4536a1b34396", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:804b25de-018c-580b-b259-7c0a73d2b0d4", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bdae1dfe-2357-5d64-8f4f-beeb9b39c5fe", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a08c4c8b-2445-5ff5-a121-f51fb9b4bd01", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:43e24763-be14-5e4e-9602-bf5aba3c5788", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d92e74a4-cfc5-5e6d-ac41-6fe2fe7b2ac8", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ede9dd39-54cf-553d-9117-60b13fee610b", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1cf2be35-e887-5c48-99ef-c6f0518b8ff0", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:45a42592-f226-5fb5-9679-16fac34f8749", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37134747-f9cd-5c7e-ae9e-11e7ba59a202", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5e04ed6d-9971-51cf-89d1-b306d3928dbd", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-support." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.1" } ] }