{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4056ac31-4f36-50ca-8f6e-24bed3d61470", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6fd93663-2b63-5a64-860a-03780a156421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:afa718a5-c82c-5e78-8240-43a0cde3d32c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9ffcd4ec-07fd-58e1-84dd-dfb5f2e7bffa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ec84e407-7dc4-57b6-abd4-48296b7e2f86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:42be3a61-58ba-534d-bcb7-4bf57aa73a9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8c307ec0-7257-5e92-8545-d7f84ff5bebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:13e0285e-9de9-553a-ab76-521eba5d3715", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bd8c31d3-8969-5274-87c7-7c2eab0f3d5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e1860454-1091-5128-bce9-62743cb1d44a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5107ef16-413d-54fe-af57-d142796cfd09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:402eb2f1-660a-5024-b992-1d654029d6b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6beaff7d-4d80-5a44-8587-9d9841284ebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7560b104-d5df-53eb-afce-4d551f5e7304", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3ed17ecc-0e38-50ed-803f-92b48bdfa4bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:709ea0e2-c873-5c2a-b3bd-a5b6103902a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:efaa978d-c7e0-52c3-b544-786150738a81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0306cc23-ddc3-58de-8927-8d84a703d7ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2a69eb41-9db3-54a6-a01b-7179ddbbd93a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3b5079a4-9129-50c5-8add-3b47fd61d0eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2ee13773-b23b-550f-ae8f-05b03a81a23c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2f76c85e-24a5-54b3-aa92-c27bd12bfc64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:047a9eef-7251-5246-a25f-abc36811d05a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9f40a0d4-40ad-57e1-b42a-940c2e187d1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a7d3a72e-fddc-531f-ac16-dc81b4841bea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b971f322-3ea5-5fdf-acad-2eb660167e83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1f9802ff-627b-5945-8dbc-a1e40da4d200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:aac971b6-64bf-5812-b1e2-bb1384e0e8d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8c08cc63-e0d3-582b-9fcb-9f58e000b0e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-web. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b34241e6-68db-54ad-b9b4-3e4f281526b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4e8f1905-7665-5925-82d9-03182e6bac4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dc35255b-7df4-56f9-98f4-be9ad2cea109", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:aba5625e-eb49-5fde-96c1-7af04a372a84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:608a7667-eb9a-56f9-afea-c6b3416a60cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ff11e451-30a4-5fba-b4a2-f651a12c9958", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:473ad303-5968-5de5-8026-dacdc1d1d880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:51e1d833-91d6-5825-bf04-77deeec61fd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:df2d8db1-d40f-5742-a290-c6e0d7da8b3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:570033cd-e791-56fd-8dd9-cc6275c1ab5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a5fa0013-a408-5ece-bfff-a02fce9e8e35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-web. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:803c1d01-807b-536a-94a3-0cbc2d58637e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8c13d900-acdc-5771-ab5a-cffd645355c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:074a8b82-9f49-5e25-8525-3d2d3f5827f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:28dcac0d-bc0a-56f6-b9a0-f85d49d08db3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ddff2985-8250-57c1-82df-c77faf326f3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bb7d18cd-8b1b-5cce-a5d3-22c3dbacdf6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4e6f0ad4-b4c7-5d03-ac15-e83b3850f058", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:aaf8eccb-5126-59d3-8443-cf922c5f196f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6d1b701e-d09d-5a8c-932b-f7f6131473d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.13" } ] }