{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1d05b3ab-d772-5f17-affe-f9bdb9aaa817", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:417031ff-4c02-5947-aae5-e87eb3409cfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-tx and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:15249dc3-ce4e-57b7-8a56-5124f7cc2580", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dda8baa2-85ba-588f-a264-02d140c134ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4e382124-8f7b-58f2-8705-455501167897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1ed5f7b7-fca9-5da5-9e88-f3cb7b04d671", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c1534907-0378-5079-b8f2-5c5c643bc963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c3799665-fa20-5983-9d31-6a024091abdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5c763250-26a0-5cfb-8797-ff0fcbe54910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8a9f191c-0cdf-524b-a6e0-57d762872170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:85b6639b-704b-5bd3-ac7b-ffbc7a4a6525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:81b64cbc-254d-5e67-8354-8c22343716e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:200b570a-6289-5247-a85c-02f99f16bb5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:fd5a945d-7d46-5dbb-a22c-809eeeaeda3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:96f02930-6541-5926-8447-30c6c2471eb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:af6d93db-3800-5302-bcf2-80a5930a0e70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:074918c0-0a95-56f0-870c-90496ae3b0c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2323501e-5995-51a2-91ee-d864ef2abe1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7f0f080a-e9d7-5447-abfb-e41b888121cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a6947e5b-26c4-51b3-98de-4052889f546a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-tx. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:55792eca-9f40-5535-9818-1eb90bfca405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e4080143-3ff7-5617-91c8-8dfce27ab017", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:80e9da77-81f6-5f56-aaea-e54a5e3e3bdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0477f0a6-ac99-57ac-b338-d4e7327e2acd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ba67bc6c-2d3e-54dd-b1be-61a658399c9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c3dd6f6c-c3cd-5d8f-8a81-ab5744ef3a69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dd9e3b66-c410-5078-8c84-a466acb48136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:914d1113-9e91-50a8-ac56-e0d658eafd72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e5471b24-8634-552c-8fd6-8fc1573ff7de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-tx. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:add129ef-a958-5e25-a562-77d07a830340", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f0c4d750-7d34-52df-a61c-ceb41efdaab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b035d442-7d9a-528b-83f3-51d8bfb8bde6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:45f29bfd-4667-51de-8c43-a65a0c62a892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4c98ddfc-55a9-56d4-bd23-9dda8634b1dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b001575c-53e8-5a19-9fd4-1553eccdf048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:28940e01-2b46-5b38-a3fc-fe994aa50e0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ab64cbc8-2424-5797-9f72-cd385dc6e66a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7ea08956-9c42-5887-97fc-9a24da7be136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:754c198e-5a07-5c66-9783-0bf80a6927b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e6786be6-4c6e-51ff-8bf6-2f462af0d1b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-tx. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:758d6cc0-3055-562c-b93c-5b9ba6214b60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:63d8c8b2-698e-575a-9773-89bd041cf8b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:515d53c5-9147-5561-bc7d-4d7835305485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e8d6b4ad-6f5b-5bf6-be7f-6ef93e7d1630", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:346f0fad-6127-5cb6-b357-1408b60c7a9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:46269758-9179-5b00-b99b-20ca5e807e2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:799454f4-822e-5746-8d24-7ed14789d963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f3e286e4-8d3e-5b0b-8554-e4aa80303def", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6d87b606-a8ed-5699-b98f-539c89665d66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.3.37-tuxcare.13" } ] }