{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fa1a301d-d81b-5bbe-bfbf-3239defcdcfc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:63c88971-cea0-53e7-bcd7-5145d7eacf05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-test and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cb4182fb-a7f8-522a-ac16-5253bd5712c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:87ae9c89-5b67-59ee-a62e-21181a14fe86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:760ae049-d8aa-5d9f-9328-8ca01376e39f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c480ba19-98d8-5f2e-99f9-b0b7368d1624", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:03617333-ac81-5ed5-9bd0-f16aa686f2d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6807c6a1-b545-5ce2-b685-4d9f5f645373", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e5048eb4-e8f4-5ccf-b63d-eeec87cbef8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4924d5ce-085e-594d-a258-cff0a7675300", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ff308693-fd60-51c5-af5d-678fb8bd8b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bb50a37d-a8f9-5048-a078-daa988d35772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:780c965e-0328-53c4-b18d-157be6202bc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:141e92c4-f2a5-5411-8051-7dde89d2f4a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d2e97d62-93aa-5064-b427-8cbb7de3a644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0aec14bb-ee86-5bdf-9846-408c70bfea18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1bda9386-ff47-5afe-ab01-204b6a9a3583", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d5a0f53f-c832-550b-b47b-d457239f065a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0a58c886-3144-5908-9361-a1aca51c7c72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ef997b2f-652c-58f5-a1ec-a399ab163314", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:75b8ab8c-7989-589d-888d-783e45a3d799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4e7dd71c-ec8a-5f9d-a22a-ecb32506bd5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:34f5d706-648a-580d-9b4d-9d3399b5a782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e5df2286-93c9-5e76-889b-a94f58ed9199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:83d9d29f-65f3-584c-9767-a2627ab91570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cb75ec15-8e66-55c7-b002-d207a638d5de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1f8b4ffa-8547-5bbe-b92e-cd52aa6e0734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:667bec8a-60e9-53e3-b5ee-9eded3631f3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ad961094-c72b-51c5-90b7-3c6c6ebe2e92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f9863286-95d8-543c-81d9-6f859f73e5d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8efe25f0-2984-5dee-af71-49560114e7cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fffb4395-545c-5830-a59c-1b4d41bd6a77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:02d09a5a-b9e6-5c91-8409-3e097924d229", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8e4d8e13-daaf-55d5-bf7c-dc88540919fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-test. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e1d16ba3-0805-5e6a-82f1-70c56f296f32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3b603d56-cd8b-5bcd-b127-8c1a08069dc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:895b6fbc-14ea-574e-bddd-54d58e567638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1a905734-3bff-5fdb-a5ca-9c4102495492", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7ad8f1df-af08-5138-baa0-609962c5c0e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:01d6d6dc-60fb-5ac7-8ab6-4b4f27f27cd8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-test. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c4b27687-5ca2-5acf-a81e-8266a660da41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a88b7dd0-36dd-5819-b574-a5835c0b6de3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4840fb4b-2b0d-515c-803e-51a4daeda5d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5fdd4bb6-36e4-5752-a962-2a6c114e88a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bb1dcf14-0b5d-5792-9d11-c0a803742550", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1ac2ad59-3000-514d-9781-0867df17812b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:03ca099d-d305-5c1e-9bc9-1178f96a5f0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d08e92ae-50a4-5b87-9b75-0351b1a5cefd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a492f149-9ebf-57d4-a661-33348a4afc7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-test." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.13" } ] }