{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:798974c6-9528-5051-9e55-1c20ebc70caf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3c2aa66b-19ed-520d-8334-46844d7c6e41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-context-support and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b4aed2c8-512e-570a-9b4b-c27e6c267573", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b984cb15-d628-5058-adb5-f635810fa467", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c48b35a2-0d93-59e0-80cb-bd690e951e98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5716ef5d-83e5-5858-baf3-6b06402c5e4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:38bf5c28-4048-5cc9-983a-8d3c53941017", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0c5a7445-6c91-5c43-ae2a-000a2c0d8d9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ee1bae69-ce6d-550b-bf53-471cf7665e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:301ad638-9f59-58ff-95d4-a5d68c5ddbd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:759eea93-5e3f-500b-991e-45db25147fb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9b859cf8-6461-5d74-a497-8441a0fa9c70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:abd8e0ae-9104-517f-9d4b-146dd9118dd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ef5fe05f-5af3-5da2-8ca7-7e572e61c591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:300e8f34-f74f-56e8-9992-20a32d350531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:160d908b-5a7b-5eff-94f3-bb96a595d3c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:adc3f06f-d63b-50fe-8529-e4d4e6bd1979", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:97e8dd3c-1183-5235-ad4f-3a0172ff7983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a0737122-0acf-582d-92c0-56ad75c484ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:82803c93-6d3f-554e-8f32-193fb676bcb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context-support. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e53f0e3b-9e53-5fbd-bf19-2df4a99f5903", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:743eb281-8f78-5e26-818b-dcbf0729dea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b532781b-1e36-57d0-8832-25f5de8894fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1163507b-0fa0-55a4-af10-c9e96bec3d7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9e0c9639-4851-5486-907e-20c98d102f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:76df4340-0cb8-5b0c-8fc0-6f66160ed1a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ab0ca695-2248-51ef-84b0-49c5eb3e4fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:298a48f9-1471-55bd-8d27-6bfe60bb55e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d21459d4-45e1-53bc-a87f-f3069e284b28", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context-support. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8fa7a284-0f82-581f-80cf-a5cf797c43d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3b394135-2c01-5916-92ef-33bee4a073f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bd988ded-f380-5bf4-b918-3caaf5e643e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:088e4fdd-4373-5cc1-a0f6-e3c390ab3747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d1da75e6-4b8f-5bed-886c-ee5704c349ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1ffd160c-9340-563e-adf8-25ccd2e12dad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c75e01d3-7b20-5420-a746-b30ba2d41022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6bd7f7db-4fee-5d2b-a7ed-049a623619fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e6901a19-497e-5506-a9a0-adc505879e39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5b0e4e35-ffb1-5298-a92b-8f4a9fb8923a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bc6ce511-1283-5d28-a924-d17ddadf8090", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context-support. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f94e89eb-f677-55dc-9af1-90a0f645221e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5a4594ba-e312-5233-9f98-551d87a4a5cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1eb607e2-91ab-5212-845b-b6d1e29f3499", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7fa177a9-d20e-5bc3-963e-f1f924cb3c54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1e20365f-60bc-5388-bce4-f34c24f465ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e4dd3e8c-d436-591d-bb58-cc6643db66b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:56fed1b0-72ad-5aab-9f69-032c539912ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:88a006f2-86ce-5e6b-8acc-08a6328575c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ef6c32aa-a3f0-57e9-8754-835309cb88b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.37-tuxcare.13" } ] }