{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a09dbcc-7220-5bef-b870-ef066370c8cd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1330d4dd-ae6e-5451-aa90-a6c4b89014f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2d9f90db-b810-54d6-a3b1-cf6013d78b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:be897f1e-db9b-5cf8-bf3b-4000c32426b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1b80c0e3-4d57-5452-aa00-9a8fee1eac19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4694ab2a-3860-5be6-83a9-0daae666f322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ba051ba2-b1e8-533a-ba5e-e6eb5a530c47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b626f9d3-34be-5e8b-a0bc-f3e8f051531e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:07f04bf5-0f34-5617-84d0-8d8eda35db7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d461a165-17bd-5dd2-b491-fb391012b49d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:13b5835b-82a9-518d-936e-1ddaaa322878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2d923e7c-b5c0-5b8e-b6ee-1c5aa5fbd401", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8eb11269-010b-5f3c-8de3-b5637633b89b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a2c7fc12-8bd2-5fc9-ae59-706441c5f38a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9889740c-557b-5c1a-8d24-e82f84e0ceca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9fa0e394-05cb-5ea5-936f-a481c13a7819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:847281d6-af46-573f-8ea0-67960a1d814a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:58f9ef13-5dc1-5b47-892c-2378fb00c6c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9c3d68ad-4527-5027-b896-c6adc2d4306f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c0e73ea8-f8dc-5795-a738-cd8d0c18129b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:837abe38-4d82-5ca0-b868-362f615c95b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:512ade7b-a8b3-5a3a-9454-2bac8c8d4200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c81b6bd6-4380-541b-9280-f6cb1c4b7d06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ceb8d8c8-5733-58a8-847c-7a3f9e3a7cd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d4369c5f-28c1-5268-b814-2a693651979b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:274fb7ae-c6cb-53a0-9773-e676af13eaa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cc78508a-e8d4-5d9e-a166-145e54ada640", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4b6711f7-301d-5a56-8b74-114f0cc34b19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1d10ba3c-4c49-5186-b1a6-746f3b0328f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:9c29492d-ec16-57e3-8abc-fb42d84c528c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:5e200201-0a84-57b1-ad0f-474476a4f4d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0c42112e-c9c6-5629-a441-1a350c5dd49c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:dd7e310a-f740-524f-8dde-25fec0f7c9b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a75ca753-dfae-5cb2-ab25-0d2af84a59c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1de26184-152b-5e0e-900e-2f2fdc82856c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:469e67d1-acf5-5cab-bfd7-be8e05913684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b9ffc09d-c1f2-5092-8ea4-0a91f9156477", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:14d6ecc0-36ab-5eb9-8cf0-cf5d57c772b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:25d39263-0538-5a8c-a390-adccfecd9870", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:054c906b-95da-5df4-a345-1d38a3e2e025", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:636da8f2-fbc0-5147-bf55-6326fb231070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0c309c1d-8ff8-525f-8451-bfbe8d030e55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:51f635f3-f637-5d57-a7b9-2733611e0406", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e5689629-be10-52c7-85bf-a9ae9c3f117f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4401a5bd-5186-5d01-aeaf-6f5eb341e29f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4370beb8-c033-548d-97ce-b6d00a102748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8db087c9-c2cf-50a4-b0ef-681b14ccb0bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d8d940f8-ccd5-55a7-9d22-50e31dec948f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6074006e-0d31-5bcf-be9e-334a430b6723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13" } ] }