{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:244864c8-cf29-53ca-bebc-84c1bc117e03", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0d1a7c9b-7476-52ae-a912-fa39c6b3e9ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-context and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f8cbfbef-d1a2-5827-826b-3a0849acd86a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fde4eb93-cce5-5b6d-b994-38c6740448ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b0713ba1-5517-5e51-9db0-dae815f9cc5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e39719be-616d-5a58-baf9-a9e0f0e66f9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4a9cd144-4543-515b-8dfc-1e55e26aa64c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ee263903-01a7-5f6a-8917-6cc02fe8e470", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1e434d17-74de-5c34-84a7-4339e9870a73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ef2f9cbd-493e-50c3-81a8-bc2e9f9997d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:07df033a-36c1-5318-9ada-29d5ffa9f7a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8c9e74d1-4a96-56a2-a14c-5465eb2c1367", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5d581ccb-bf11-5207-9e0d-db58d1d4d7aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fe3c7eb0-d8b4-5a86-bfd8-2a7fc4923a62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:134db2b5-abef-5926-b53e-e371ab519a8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6e75be92-52c8-5887-83ba-a415acd9969d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8ca6835e-a54f-5277-afb7-c7af9b2f53d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:83feb4d1-6c74-57c2-bba5-c17b9d546522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fdeb4b87-dbe4-55d5-bbf8-b69b75b337ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:77cc08c2-6cb3-589a-90b4-1201a1958d5d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6dd8527a-aa4d-5739-a0eb-9e29b88f689d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:70596e65-1ed1-532e-811b-f4ccab78a21f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d0b4ca0e-4d91-5151-b314-4e51a35c6416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5979c4ad-0582-5f35-84ed-7a9c13055968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d7654fc5-cb01-5937-95ba-7db1610f8f59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e618f6d9-ca64-5245-8131-a2ebfd62117b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:69fbaa5d-c3de-5e92-a732-12b3761d77b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:01a93294-79fa-5189-8ffd-bbb9b3f00e0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6387a59e-760a-5281-bcdc-1347e0a8fbde", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7df4975c-9870-56e4-a25f-3267e94e37a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5d30b444-54c9-55d7-b1d6-22f6298076b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:da85ab00-b30f-569a-aec2-370d4fc8a4c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:47a27978-edd9-5ddd-b585-fb0827ad09e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8abb7b3a-4355-562a-8ad7-efbaabfa984e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7073a3b5-4780-5195-8746-1d84d7841095", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3368d5f7-faaf-5b9b-be4f-55221581c9ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b76c13f7-2e85-5554-a491-b054c8792fda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:43354bb0-b85e-54d8-b873-8cee069f7c8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e8838082-93ea-51b2-a681-79d7582b3aa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ac46dafa-2dd2-5052-935d-d726e29a463f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-context. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0343dc62-e2fa-53ca-be7a-90f5ff7320f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fd05e1f7-4422-5273-b884-cb13964323b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a2f69916-f5e2-5212-b246-20d6bd046e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ffb56241-e610-5cc6-92bd-59188fbffcf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a911f85d-4661-5cb9-b0d8-83cbb379ea20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:71fbecc2-dacc-5ef4-b29c-b582fecf4806", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1165beab-5bd1-5496-a902-801e91aace7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0c486408-9e2e-546b-97e9-0879502bb180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:90845943-0641-58fc-9040-d068cd292a96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.13" } ] }