{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:542b8356-033c-5a5f-a3e9-6cab26b9864b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b737045e-9f84-5dfc-8f80-b5ae1e086f50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1f9d9956-a5d2-5ec4-828d-b35e07d27aa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6d0ea204-93e7-51c1-b0c6-3baea5499b7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:650c64e0-6284-516b-86b3-4d3af97085b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0a60e8d2-6e67-5757-9f5d-17a539cdf9d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0de792ab-1de6-5220-bdd9-5a360decb19d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:75e9784b-319b-5a9e-937c-c28de16de943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8855f7de-7ccf-512a-a6b9-8f5a3e6be9de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e08712f1-579f-54aa-b613-0e3a52a8effd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:42892a75-3975-5d61-b21e-a19952d5a771", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:50c410a1-80f8-5a81-b5b7-2232364bdde2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6b897c3b-1193-5127-b1db-d706d47d0fbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b888ae13-539b-590b-8091-2b3fdc00f48f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:422f5eaa-7f77-5918-872d-99f5780ff684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:728538e8-3e65-5986-86f8-3c1fc2e423fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d4919136-465b-544d-831d-ccee26e9578e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f52d528f-8fa8-527f-b0d0-068417a2ac23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:838abedb-ebad-5f66-9175-ee403e245742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:04b615e4-fc30-5913-8ba4-e806c27fa26c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:234737fb-9a00-5d14-85fd-c694b7ee193a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d49d85cb-fe83-5f4f-a58f-22930cde320f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:053bccae-58c3-57e0-a196-70156fb4a2a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:00bbed33-a890-5d75-850d-94096c074e94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:55d5571a-167c-5484-92f8-791996665a95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:66724fb7-9c03-5ac3-938c-4fc7b7346e32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:914c2c2f-96a0-50f9-b7ec-b8064d2cc6e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f4878651-c665-5b65-b9c7-b9503b536a31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:99e46c4e-ee2d-57bf-ac66-2f1e57c0d911", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d7c8122c-7401-5026-a31c-bf7120445b05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:eb3383fc-4901-5ce9-8972-371d6d713a0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c08e62b7-6237-5c7b-bb31-183d7de0fa23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0be5e10d-2449-5301-aa32-ea411946cd89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1a1a720c-cfb9-5311-a55a-6515ab4faac3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ad3054d0-f553-5ffb-94f3-2787f7ffc8b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:239deeca-3383-5a96-bd13-e430b2ff2402", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d6ee0cdb-791e-50e6-a1c9-896dfd2df956", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8cf14cd0-5d34-53da-bd24-9582839e7164", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:93252e00-067b-560c-b064-5475687e1a60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f4415e29-a5c6-58e2-8270-b67a477127ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ee2136d4-fe77-5639-96a4-4c3eeeefbc3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7ce165c9-4552-51c4-a098-f1096289433c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5b28f773-5cb4-5434-8a04-abaa4234b08a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b9814138-0ac4-5947-80b2-ecc0ae348353", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7d6db2e4-aaf9-5abf-ad09-be034479f80d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:43921379-0062-574c-bc7f-8ee7c723c930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:3dc910cc-6f77-5f04-889d-75f4654e8d61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5ec14234-68dd-54d5-b646-b665ffb5ccd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9aa4f2a5-9874-504d-a92c-e166e51b05cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.13" } ] }