{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e035e64-be95-51ef-87bd-25861bff7472", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "5.3.37-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b0f7d002-d597-5fac-918f-35aa52530602", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d671b18c-94a4-5883-a215-f8c8ba00757e", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:128d5b36-a08d-5dbf-a5fd-990daf4f6e19", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8c536d2f-7171-5cd4-8866-0207eac25e16", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c9ee244a-532c-52a5-b451-376500a4eb10", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d9be7279-e392-5168-b170-615d6e29e498", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:68b385dd-5329-57fb-b7a4-293de96a1fc3", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:79d1fa39-dacf-58f9-a464-1a4d4e878a38", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1229f6cc-eee1-5362-9638-b74d6f724e71", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d45540ae-5b6b-5443-ac58-0cd398450e77", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d5130c60-ac2c-5e3a-8f8d-e2bfe9e39243", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d8ef0ab5-411f-5bd6-970f-f2e70be7be2a", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:726abda6-fcc4-5e97-8546-475e48474c00", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:839997f3-9759-5192-9130-5f25089f1973", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c4326e52-8533-51e5-93f3-a1a6be419dac", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bf7c0ca3-7d35-5050-9204-9b80c7dd0bc3", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:17156bd3-3f90-5a9a-be33-eae3964ea029", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1f124874-f777-53c9-825e-ea418d8e1b62", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4643fcdd-66db-5749-8431-480e8fbdd97d", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.5 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1ac65f0f-6c35-5b16-aacb-991d92f3c853", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8cd146ba-18da-53b7-899d-6faaebda4ec0", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ab7137f8-d075-5ba7-8ada-c7048ba88a29", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fae44e09-3af6-58cf-9cc4-a6db69e15502", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ef246084-40df-562e-8836-678416971866", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c1377d75-2775-5be3-b02a-83e42b157f66", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7df9470d-b49c-517e-bb3c-c99cb52af49b", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bef947b9-b123-517a-8ebd-55f5b1c4fd6d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a94ce897-056a-50d7-9114-4a2e4f30dd53", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.5 of org.springframework:spring-oxm. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0f3dff53-b9cf-5443-a9b5-7489d887bdbe", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f65beee1-95b0-57b5-b34c-5c43efaf8130", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8c9e19bf-f472-5965-a4ca-10f985f7bf73", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a404925-d8b9-58cd-a5bf-38452abeb0d2", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24dd3231-a726-5d47-b699-736b8b9e7071", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eb173a32-eaf2-5c19-8f8e-7dbc0fc61eed", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dca3f786-d1b5-50d2-a0f2-c1bc679cc310", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a667034-2c8b-556e-a1ee-ec96aa48612b", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e9254405-51a5-54ad-9ca9-02f2fa9fd2d0", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:07fcda0c-77cd-5e10-9ab3-b5507cbb9257", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:13a1c177-5e0c-571c-b1a8-01af543d270a", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c1b0ac20-5b29-5dcd-ad66-7f3842269911", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cd306dac-b145-5d7b-97c7-5c050219a306", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:eb6dfcf7-4acd-5f97-afd7-7d86dd19f539", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f3a6a8a3-4b6b-5c65-9fc0-925b858f061b", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a43a6f1b-1e1c-5b0a-b77c-1a6c62c90c07", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c8fa3941-da59-5a5b-9d86-f0543be2c5fc", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:944156f0-8398-50b2-82ab-f90803ea66bb", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c00469ee-e9b9-5adb-a4a2-89af85a4b4fd", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.5 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.5" } ] }