{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a1afc775-1acb-574b-ae0f-ae47f26bdbf7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10", "version": "5.3.37-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:84895fd5-2e3e-5ffc-95ec-b8ff428ef82f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:6269d8df-e529-5f2f-8d9a-be84812877f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:bb272f60-d311-5443-b0d7-b0cf8063d0bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:a4eb73ac-2010-58f0-a00e-9e84dc788066", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:e8ac411d-c356-5621-86d7-d297ac25e0e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:1ebaa11b-b3cd-5add-bfa4-2a29de41aa7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:78d6c56a-3b9a-5acd-9bad-f83a47b99bc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:9849f473-92ea-5462-9f83-7509d16f32a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:1a1d8673-2555-543f-ad24-d22e53609bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:ed70544e-21d6-5e5d-a627-4d98db471259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:c9c061f4-8aae-550d-8049-bf6f53df3640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:1cc0f0b2-c85a-5671-9a85-e73f044efeaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:ffc42003-b265-5cd5-a74c-ede267848be2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:72a58337-e8f0-5dac-8e9b-226eb088ea66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:b1c24552-2282-5174-82ff-e1779ad5dc46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:4c42cf1f-d884-58c2-848b-d44a23453c78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:b586e111-ed01-5d16-bd95-7786f4b463a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:517abb86-b802-5e83-a98f-a5a31e4f55c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:3b4e768a-83a0-587d-93f2-1c4a2b5ed2cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:147ac862-aa35-5881-8426-6d6135cd6c70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:1cfdd713-a682-5f40-b627-e4a19a17c4e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:1fa6dd3b-91c3-5b3d-9f72-d37169ad5af3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:3835e98b-eb69-5c6c-96e7-248fdc0d2d66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:b02ffb0e-08f5-5627-beab-04cb51bb0624", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:a9a438b1-db65-548a-86dc-5edf8156fc46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:27c8b920-0c0d-50cd-bd87-e9e561514a3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:6e474593-72e7-5203-865f-65d081130785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:0f244f93-91dc-5a1b-8700-46ad528f08a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-core. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:8e5dd9b1-08a5-533a-b4a8-303b79b5acea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:5cd2ae7c-f97e-5d62-8ec3-1dc845cdee13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:f20d61a8-51a3-512a-9a88-dd22db5a94e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:ea42195d-d315-5b8f-b460-767090fbc162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:ed44f73f-3565-5a71-bda6-9df93dca5ecb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:5366eede-c6cf-5a24-9812-98d746155544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:5c303bee-0a87-5e88-b57c-221f85933905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:0307d699-d169-5387-85fd-413f879c7cf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.12." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:7f7dd609-b282-59d9-8094-38f75353801d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.11." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:4d883728-28db-530c-96c3-98b6d2f7cf69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:34609fb6-40d8-5a7d-b951-6ddb06a28cea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.11." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:5b94ec05-c4c9-549b-afcc-af816abbcfb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:767c9a8f-33a3-5ae0-bc76-55afbe699401", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:4e9fda96-5f0d-564d-b9c1-a203a6c8fb2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.11." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:26c8b4ac-0bbc-5842-aafc-47b2e784470c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.11." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:fa06ffe5-1400-5225-96dc-e239c1321194", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.11." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:dac09a4c-2053-58ed-8ec4-179120f3a0e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:01c2bbba-7220-5083-8328-a5ccb23d82c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-core." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ], "bom-ref": "urn:uuid:addc5ae6-ed51-59d6-83fd-627b96fcab9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.10 of org.springframework:spring-core, and is fixed in 5.3.37-tuxcare.11." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.10" } ] }