{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:76f777e2-a856-5ec3-803f-2e693105f890", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e158b747-b81f-550b-909d-c8c4f64bf9d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aspects and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:04d91121-2499-57ce-b0e8-9fe24aba081d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:30a1cc90-4e63-5a24-b3e9-a9beb9673b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f0527350-4fc2-5578-b5dd-0ce217986092", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:84f4e9f4-44d6-5e3b-aec0-60a78b1371f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5d85b282-87dd-57d9-94cd-cf87943ead9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:178d24d9-b62d-5ff8-9d8c-cf2c00355506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:17d6feac-e031-56fe-9412-b919df5b40f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:def512e3-8777-5c03-9e77-29374e1efa05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b23747bc-3c48-534d-a0f7-e786e8e98db7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9b8054cb-65e9-5e59-975c-694624271754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e9afce7b-13f0-5f57-8186-d7d475b22e6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3082eb5e-481f-5d8c-aefd-2deb04e2ab4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3aaae849-67e4-5dd0-9ab4-b35523ce5550", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7d2d6590-0337-53c8-a8f9-765a8e104ed2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:01d3e687-c7b1-50f2-9276-b7b62132b008", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f44df8b6-becd-502b-9b77-4ccfb2c155e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2e6dc8f2-9428-52e5-9d6e-bd95065d862c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e9b1fa56-1379-587e-9cff-e6b47dafb2c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-aspects. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:81c87fad-4453-54b0-9732-25df409444e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:449739b7-d630-57c2-8ae9-3d99552f20cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:30131d97-3ff3-543c-8b13-be464de51064", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7dc161fa-ee67-5d27-b3b0-ec6c61736491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f21f5fd9-adb9-5006-8694-9e44ed43de77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:61d5eb5d-0774-5a7d-aec7-4c8c5fffcc62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0595b7f4-8e45-5f6c-a199-19d22fa2e90a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e4c9f962-f112-54e5-8ee4-de818b71c475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:347d2308-8b8b-5a8f-acef-770375085dfc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-aspects. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9a8386c4-1912-525c-a686-85c7faabca77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:43dc3355-c42d-5d36-bc6d-a767da9095a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:87a95b9b-dcc9-578e-b191-3b6edc748ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9bbb4737-0101-542e-8f6a-dbf2d9f539b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6a92b1c7-a41e-559f-a819-cc4a29951685", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7ee399f3-f10a-5f25-984f-2788b1e39516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8414f50b-b2ca-5ba0-8a24-1a18e45d61af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:160b722c-e7c1-51af-81e0-b98e536ba26c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:000ea1eb-87dc-5394-be0c-52d8093c990d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:910ecf29-9f90-59fb-8ba1-41457479e042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:08a0dbf3-6c6a-577d-9c72-52e63d3d7259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3b0fcaa6-c31a-5d92-8ea9-dccf0fa015da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a8826cf1-6835-588f-91b3-f8d212ced023", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:58ba8c60-7787-5f98-a387-c6ae6dd76f9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e04d9334-7b42-547c-8b3c-ac860076de3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dafa83fd-8dc1-5ba4-95a3-afa900a43f2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3587c23b-5cfa-508a-a43d-78119ed79417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b802b49d-88d7-5d33-b95c-8c450601ae9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:162630ce-8505-58bd-a604-6294af08d1bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-aspects." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.3.37-tuxcare.12" } ] }