{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ce6323c7-ef09-5ab2-a4fb-41089dadc95c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "5.3.37-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:39ce9ef0-ef10-503e-8ab7-481331f8038f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b13a2c6-cde7-5fe1-b8a2-eb19cf49684d", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:928d627d-47f9-54f0-805a-3f57df22fefc", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:64ce17a8-30f6-5976-80e2-71d756048b51", "id": "CVE-2024-38816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2b6c3f1f-039d-5854-a7ae-7109c10ab7a4", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3055fc1e-c53d-5d18-b1cb-1509553d0119", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5dd279ca-47d8-5e87-970c-05150ab943c0", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0f95c934-baf0-525a-9547-8dba785244c8", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7f3194c7-2605-544b-b6b6-c3e8af2b0c5a", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9911a733-8047-5922-aba6-50e4e8abf95a", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ab18fbb6-1adc-5c6c-b8ff-1fdf48ac9dc8", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b021747b-70df-52ed-b870-ea289dc1c67c", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3d5e8ca4-4915-58b2-bc45-aa66373f33a0", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f1cd9a2f-587b-5374-9517-8ee5019bac49", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:34dcc17f-973f-558b-b408-a9e935e30bed", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:01aa2941-032f-5727-9afd-330a15e54d36", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:529fec82-42fc-5a34-9fb4-7f60043c20a1", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c097bafe-295a-591b-ac62-3ad11879ecd3", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e2779902-4024-5830-a65f-671185431b94", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a06e95a7-569c-5713-8fad-30f3d1cf4015", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1eea956d-1204-5d6a-8798-25ec6086b543", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f24da049-f9c2-5a62-949c-624a4baf6b4a", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4f761df1-361c-5b14-9c10-4877a9088323", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f91e352b-b1aa-5429-b152-ebe4c749017e", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dcd350d5-76ab-57b9-9227-3dce6b84ffcc", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2b6cea03-d8de-5a2d-bd07-9cc87294c3de", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:52db6103-2764-51db-8414-6fef58dfcfd0", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ce1957b0-b43a-53c5-b0f0-8424e8528241", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.1 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:369b2d17-6f42-5308-a21d-8dcb83e5696c", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1597d36a-28de-5a6e-9add-a0d20dc81347", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9ddfeac8-8b13-59b0-9e85-e6c0aee38dea", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c5253c49-76b9-56be-8307-8a7796bd32d8", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7b113768-d1a3-5664-86d2-44b99c36c708", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.1 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.1" } ] }