{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3d77f000-ddff-529c-99bc-49b885349e4b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "5.3.37-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:38424d95-5457-5c5f-a01e-d96dbd811d0c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7c12eda1-e5a4-53c2-ac15-00c6cd11d15f", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ad683a11-9b1f-50d4-97f6-9539740869e7", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:36aa5b4b-8035-5207-b12f-4451ee00680f", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f27df198-e6fb-50ec-935f-e66cc477f0fb", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d1bc4c21-a4d3-584f-a20d-4d874d294f86", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1f9e00cc-1c14-5f38-b5bd-8c892d0212ce", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba8ba79a-e82f-58a3-ae41-fb0f8c434629", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f8584ca-f95d-5b0c-b4cb-735d611bb43d", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7d57d42b-9752-59c1-84af-9bf82483a089", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cac01a21-7f7b-54bb-984e-5997dd407b39", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb2164ce-6dbb-510a-9656-3e8eee2b6dd0", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:db746440-6c09-584e-9476-e1c6fa7eb912", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8d4a796e-cc3d-5ca4-beeb-aba911e6f3e9", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:17e4e30f-d355-549f-bb10-301c899f19a0", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8d43cc14-e03d-5a11-ad5a-7d41c75972d5", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:935ec1f6-a821-526d-8036-d4f098ed3cec", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:45594baa-e4f0-5221-b8b7-77ed53bc258d", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8b0d2b59-de40-5b80-84d2-5c858ca66d43", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.3 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4e82c179-b33e-531d-8696-9d753c60d07e", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3d9fca67-703f-580a-9383-b4ec81ef7e88", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f9d8d2b7-ef3b-5fb2-b222-92e4faf59189", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:83ef441b-751e-52bd-923d-cf1093c8dbce", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:298206b4-ec1c-5635-b2ed-42b696b3b016", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:820856be-c617-5706-868f-63ab7f97dd23", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:298a66a0-7369-5529-9aa6-02e6e8dce8fb", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bbc3af19-2cb0-5cf6-8c44-62472218f566", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c017fee-5eb3-5367-9c15-231ba9f3e686", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.3 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c2c858d8-94f9-5d46-821e-4c5d71eb2490", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:27b014dd-96ad-5054-9a3f-b6c5d8b20a0e", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2bdb38be-31b0-5264-ac6a-ecfa064975d3", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bd7a9b31-d868-5b72-841e-810b3151d59e", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7d7f813-0309-5406-bdc2-2f1c12463184", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.3 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.3" } ] }