{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b6662668-8d64-5fb4-83eb-cb67bbe95045", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ddcdabcd-db12-5f81-a0b6-a88ecc606380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aop and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b506e8f9-4e6c-5ebf-9b40-eaa2eb6be762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:98c255a9-6ea8-52df-8c47-69d1fc78e6b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dd0a6f25-9345-5d2e-8243-dea77ddb292f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2d0fe498-d1e3-5c33-9a6f-50f8e7a22c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7acb8563-66b7-57b1-8008-ca8c7a5c94f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e5743621-565b-5f93-9f21-e4ea7386fca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b3209a8c-5be6-5211-907f-6bd7329eb2d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:29ed3090-784b-5050-8e11-cd669ef55206", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9f85b2c6-2605-52fe-bdbb-50e524d548a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f8ff65e8-bb21-53d6-a558-268de5081f78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:efbba0e6-cb71-56cc-8538-ac2d131a1e88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9aa4ac2a-33c9-57f1-8e4c-51c7ebfccd40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dac05168-d510-5f17-b934-a5e4cfb24d01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dd107873-cd59-55f9-92ba-ebe10a240693", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a335a9b5-0a9a-5467-baa6-3fab8ace9c34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:854b3daf-becb-5423-8a5f-afaee9c72694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c29288bd-dc20-5edb-80da-de2f5c00b277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fe0c9d1d-b2bd-512c-b8b4-fa6420387c99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-aop. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:16ea4062-17e1-517e-87d0-3e32f25dc5f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5dc96f59-c86d-521c-95f0-0861ef4eba54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4bb5ecd8-2753-511d-83e4-23c899730c45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:51c0859c-8142-57b0-91e3-b6d9d7dc89f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a136738a-3c8f-5a19-94a0-fb8b7e51d368", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1d81b9fb-f87c-5812-8edf-109c1b48559f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3306cf38-c884-5292-b50e-d478e004597f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:aaeebac4-e703-595a-97ee-7f78e7c39af8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6796bb7e-313d-539d-85e1-d2bf2ab7d8f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-aop. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fed612f6-4867-5cf9-931b-3117ed9689b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cfb01a62-3bc6-544f-8aa4-c47d45ecf46f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7fa3019f-6e3d-560a-9103-adef97461615", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e5bdd352-23a0-5adb-8537-1e90a9ff4b90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f982b832-d9e8-52a4-98b9-8b1f50fb94ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ee20931b-f696-5f6a-b095-3a22423f1f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d6c233de-8dce-520d-a9d0-a3ad518c0f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e39f3bf5-078b-59af-985e-f05cfc6095fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8fe44bb1-acce-5edd-b966-23a3fa84c2fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4e7a56fa-9ab6-5fcf-8bc9-60c781b764b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7df70295-6805-5fb7-bba4-15130fa7aa71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a2514744-9212-5708-91ac-0dc1044e1d54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7a18f2b9-8981-5161-8bea-6a3c006e57fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:90dd066d-8ae1-58fe-8999-9c04a2d58ebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3251f664-72b7-510d-99d2-08882edce540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8d3e5005-5d73-565b-ad53-aad99fef772f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:22a424d0-fd38-54a8-8cdd-f8769c39f9ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fb2f3026-428c-505a-a94a-0a60cda9ab79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f9fbbd95-6f70-568e-b289-24154b9f0db0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.3.37-tuxcare.12" } ] }