{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c7cd26e-d807-5774-bb31-15add5dbfc46", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "5.3.37-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1fa4365a-edb8-5656-a71a-043e713a8a7b", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5940169f-8c61-581a-be89-340d1cc26d24", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:94d2f699-eae1-53dc-9dbe-231e5432d318", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:867be7a3-8606-55c4-a202-a7a148f99817", "id": "CVE-2024-38816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7e7f9ca5-ba09-5235-bbdc-6c34783e93ad", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8e4bda8e-4e7d-53cc-a33b-02e15e64e238", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f4c7793a-1721-51ed-ae57-9c14eefead06", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:676886a4-4fd8-58a6-908d-8fa3dd1ae741", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fa94afb0-8b1b-55c5-8ab0-459d05a375b6", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:809e1db8-4674-580a-8600-5c0229097bed", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ebc5b06e-39f3-56f6-a258-2ae376707017", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9fef537d-b448-568f-91b3-39d0df0b129e", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb906156-2ad7-50d6-9033-f6818a46a20a", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:27c865c2-a9f7-5e78-93a8-1f24ebd7ffdc", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b20748f1-8a88-57f2-b340-f0f15038d2e8", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c5040de7-d4a4-56f7-ab42-df39c5872983", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:89509660-a58d-55f1-94b4-5168da21a30b", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:910f0744-dd52-5594-a559-84ba4486997f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5851ced5-8689-543f-ad92-55700903de68", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e0c860f1-7665-5e85-b864-23dbdf82a046", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:180e7d16-7a42-5817-9233-76b1a085ceac", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bc1de8ad-8868-5c3c-9024-f67a95885615", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:627ce826-f32f-5e27-8273-0822b1c009ad", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:86720707-84a5-5ff3-b319-7b9e138017b2", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8c903d78-4f28-5d2d-a92f-7666d219a27d", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:79a63a63-4e02-5249-82ac-63280c0cb47e", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7a46624e-08dd-5ee6-8696-fc98fdd4e653", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5b62b456-f38b-5864-9773-4d57ec6edc40", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-oxm. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b272018c-d753-5fca-9ab1-bdd4c10669e3", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bbf98712-1a20-5f5f-ac36-42ca79a0174a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2ef9c084-aace-5772-b4d2-008cc5427533", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:960c7ab7-5430-5ff7-8ce7-e905be595345", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:db0842a4-5ceb-5fdc-bb51-5c58fecc0a69", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.3.37-tuxcare.1" } ] }