{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9da2df04-115c-5e4c-b974-6fdf39c64363", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e5e19971-df6e-5258-96e0-c3c51d40d71a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-oxm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:79a2d22b-db51-52e3-b025-c2d44dd9ce1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:114525b2-38a7-5ba8-b5b8-26e4c185df4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:48176432-0dd2-532d-add4-7e3e229cb6a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:eb590ad5-34de-558b-9a4b-000533f57138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f4f622f7-9459-5766-9205-51de562aa47e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:216a9963-b5ed-5d29-8e12-57a3af7bef47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f9e068e3-025d-501b-8099-f1aa4aee1395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0236e591-0d3c-5508-8752-c16c04946dd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5746d67e-e652-5d45-a751-7184459da17b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e5161487-63bf-5c9f-9f6b-34544966f84c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:59e1d54e-80ee-5eed-a5df-2e7968a6fea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f399bbe6-1f50-542f-8c08-dd56ad9b89e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:093dedfa-3629-5cec-92be-78511c02bbce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f2ec80fa-8a50-5c91-8129-a4f5fde8baa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:55a81391-f723-557b-a195-4d33b435fdb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8721d2b5-343b-519d-91e7-f2ba2adf7faf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:30b7efaf-76d4-532d-95f9-6649815b9135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:225836df-5ce3-5a00-a413-2db9aba408e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fb6ecf7a-332a-5b96-95cf-1f6a1a326aaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:43dabbae-ee90-50fb-804e-87ec3b0bb631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5782cc72-e706-50ba-bf2b-9d3f17a12237", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:87bf16fd-e5dc-526a-815d-836433dfc916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8c7db908-d653-5d9f-b6a4-c894f508a59f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a02cfa67-7135-5267-ad07-d794008f0abb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:60cef4ea-5ff3-5c10-94e4-3c48921299cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5466df05-f333-55a3-8a37-0fd4b046fecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:752a0f97-825c-5e44-bdfd-569558bde575", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-oxm. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:77e01fa5-8717-54f4-8e84-aea933f06eaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f862640e-f412-55a3-8e08-014e3df97b55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1cb2c6fb-5a8f-51fb-978e-b64694a1d8a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b4197bf3-9efb-51be-9c53-c0e14e69d5ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2067abd7-70a6-5e57-82f2-1b25a5409279", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:481241ec-9419-5825-a04c-c7b21e73b6ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:222d9077-0d6b-509b-9849-aa58ad71576c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0a3f2280-07e3-5f74-a248-ac37fb16ea5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1aa6920d-0a1d-57ed-a342-b41ca6a201cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:13e26c2a-cb4d-56a9-a783-51a4b807ad4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:38c04bf5-da23-5adb-8b39-a0bb6e577d84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-oxm. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5da87147-8714-57ec-bbac-c6be32d6ab36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8673293f-9671-53fe-8f86-0dabf758273e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5e780586-c8bc-5b7b-b71b-a9c1787f3d74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6e3a96a6-99d7-5389-9dc8-a7cb9ee03df0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1f8f280a-f537-5cbe-8b59-50a31ffb0c38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:628f3b68-922b-5ff7-b7a3-f909366baee1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:55fd1c59-ba44-524a-b54c-36d044e886af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:095200b3-cbe6-5b32-8c66-9ac585a9f153", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9cc06629-32eb-5825-8827-c282a46f7b70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.13" } ] }