{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8c788e4d-7916-58c0-ae54-f302cb8d3a31", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-context-indexer", "version": "5.3.37-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f1a2f138-7f73-5d71-bc14-66465d6f8d8b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ae4ad3a5-21cb-5913-a904-2e160b286f5c", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee3ac3c5-a70c-538b-b4b1-e2ded110c897", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a2ef5448-c2dd-5e93-aa94-4cf4663e86e7", "id": "CVE-2024-38816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9550e7a8-f4ad-522e-b331-f9115854f688", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:778cecb1-f897-5541-a049-6889c5f691d3", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:02f2bed5-d41d-5010-b89f-7348351462c7", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3554c00a-8a30-5009-977f-b78d8054db90", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76353d24-e0e1-56e6-bf00-56ad9659cbb6", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1fcd4f51-215d-5394-9fad-e8bc902ca8b0", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2572d519-75b9-5eeb-8e5a-71065c485e5d", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:74056b2d-3ae7-54a7-a552-da899988f188", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f5b36e40-295e-5a36-8e54-aaacd79955c2", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1529c039-3172-5beb-bab3-d140fe844f13", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b8bb5202-20e1-584f-b547-5d5ba116d331", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:06f7c09c-3c51-5c14-be90-cf45ec772225", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c48d4140-a870-5ac8-9783-571c4e0868ee", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a4129a9b-9eb2-5dab-ab38-22dcaf8cd371", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ccd3d24b-5856-5dac-b398-0cc606975064", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee68de91-e099-550f-9512-aa262cb3e78a", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:95f0bfc2-6989-5af0-9fff-2de39850ac82", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f464efc-acfe-5f42-b268-c103f1bb4b3f", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:65d8d73a-f32b-5e54-9d9f-49b6d4356801", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:32501ae7-87b4-5f58-b927-ccb2a6f3c3ab", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:934749b3-8a08-53a1-b9d0-7512ac8adf54", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:12b78d60-810b-50e3-9f04-e9861b560331", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6d650018-1b5a-548a-8c86-df65a1f837e6", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:af0c7190-91aa-5974-8bee-660d68117f12", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d102fca4-73e0-5405-bd05-654f3a369f52", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6030dc62-ec2a-5756-80ec-05ae015360a7", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6e9796d-6ce5-595b-b12d-16cfc6d7145e", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:745002b7-6dc2-5ed7-93f3-b6f01d413750", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d430ed9e-ec0d-511f-bfa2-888451d718fc", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.1 of org.springframework:spring-context-indexer." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.3.37-tuxcare.1" } ] }