{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7124c6d9-e283-576c-8a7d-35215a5a9910", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6c19d5f1-21e0-5d8f-9292-5c3d9bb28ff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-oxm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5292db47-162b-5948-88a0-0a0ea361d191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4af7afda-7c28-5807-ad77-6c8c695cba8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9be749a7-4d3b-5a68-b66c-8acae79da1eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2c0598e3-859c-5303-aa8e-f0053f499b8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bdc6fad0-1e62-5039-bee4-13885951c003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6cfd11b5-7d4e-5cb8-8e78-28863bf8be97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:34dc2132-8dbe-5120-845e-4bd70b4828dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ff3dc094-b0dc-585d-9aff-55c07bd5a984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:018d28c0-717e-5cc8-b209-8556aa1c3c14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:482ce0cd-63e6-5983-b5ae-3c883599c943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ed2427a6-6a0e-56cc-a53e-a5364a371f17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f84fb0d4-4c3c-518a-9f9b-404ebeea6c8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0959031d-09aa-5353-9fb0-8ff4e858ff4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f36ca6ad-f592-5b51-8678-93b3c38d8fc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0fee4ca3-f373-55f4-93b0-6e72a03e62a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8d0c9b32-1791-5005-be30-cbfbfea99284", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:073b990b-1548-50ee-9ddf-3aceb2f84ef9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:31ca0a74-1a70-53fd-8a60-d4f2b7952c3a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6933122f-22b2-5eb1-abcc-838733559930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:81bf5de6-7c1e-503e-b9a9-b7094b467f6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b316bf47-5649-557f-931c-2b42587af144", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c6640050-e94f-5487-924c-5aadf40035ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9e423f76-ca3f-59b7-b286-18b89fe0afbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1eedeb5a-f802-54e2-8fd6-564bc87528ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:83fff09a-a278-53c4-959d-bf86e2bc9ba1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:737504a0-1b95-5f05-969b-b51027f81c44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c1e1bb36-16ff-5976-aead-2c2fb7ef7a9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-oxm. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6f426bb8-50bf-538b-a9b8-46b7246e01cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:eeb493e6-af36-50df-91da-b94003a9ed28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:21baa554-656a-51bf-96f7-b189d5e9a138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:93ecec38-3f78-5912-93cd-506c408006c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:11f8b38d-a989-5dac-8d13-bda430fd45cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5cbfffdf-d50c-59cb-8224-f3eb9fe396cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ac20f150-2db0-554e-81e0-e4368eaa604c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:92dd2c80-964e-5f0f-99f7-dd721f9447b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b59b46cf-2d5f-5856-a657-520366a0fa97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:888aa7c5-6cb3-515f-bab8-6896e1e85ce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:36359a18-1429-59e7-b071-1f6d6569690a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bf8a03d1-23cc-5020-9e4e-4cbe2f3fcd60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:39d713a5-bf74-5d94-919b-067764429db5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c33c8647-89a0-592f-b938-9c80ef9f8011", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cdf657fb-f49e-5e48-bf77-719db469eb9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:acdb579b-8f91-585a-9afb-d14000d248b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:98426580-4b98-51fe-b760-41039ee6968f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7fe869fb-d5ef-5eaf-bc0e-611454a4174c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:76c9cd02-4392-5325-8da9-53ee4c5d0924", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.12" } ] }