{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:62989f8f-99f1-5845-ac03-1b2293eb41e9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17", "type": "library", "group": "org.springframework", "name": "spring-test", "version": "5.3.39-tuxcare.17", "purl": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7a727e30-ce3c-516e-95a1-5bfeb46a9a8d", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:30bccec8-91e9-5a01-a330-e30ab1d61723", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-test. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:2d7ae171-ed88-5409-a752-b6ca16fff233", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:9cfeee57-c7b8-528a-9234-2484f84d3e2d", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:eb270ca0-994d-5d5e-b13e-ad0437951747", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:fb3e1f3a-254c-5f5a-8433-df3e2502535c", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:4c9156bb-f800-54d4-880a-6a32be1a7947", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:fd204e07-65ec-5b43-9f63-cad6aef3db59", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-test 5.3.39-tuxcare.17." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b1aad4a2-c7da-58dd-aa96-4f55fefd67aa", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c5db37a0-683f-5020-b299-abb33f205985", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:556e73bb-7f83-56ea-adb1-a572553afada", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:06041aef-cc16-50f3-b189-8660ffe8b9d8", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c6f419c9-8df4-576d-9a46-4596c56f0fd6", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:cd8eb7ff-c443-5091-b2ba-d462fc987f63", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b2c14e8d-7e63-5f4a-b29e-8cec5de9ac65", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:44b4c6c8-35fa-50b3-aaba-594ecdbfa68f", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0d6a695c-a61d-567e-a10a-581a3144e67b", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:7fbb7ed6-60cd-5344-ab35-091633a1979e", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0fb4f18f-b194-53de-bb5f-2918b9b4876d", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-test. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:923704a7-8614-57e8-b7a3-ba7bb821f7d8", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:70f4c1cb-18ec-5119-a2a5-573648c5a4d2", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c8e7075b-ef0d-5bbd-aebc-35de7585eae9", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:13b9afb4-e8b7-5a2f-a428-e7a6828d5e77", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:124a90eb-387b-50e8-bfc9-a03cc3dba994", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:ad106eb7-9150-5876-8012-ead76dba14a7", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:cc5cd0bc-f3fb-584b-b7ad-04c8c9fabf24", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:84e37e8f-7f35-5e8c-8b90-7aeabc11f678", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:cac51e2e-67d0-507a-833f-bb4dde195910", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:603b0912-ceb9-5650-a867-fd124ef737fb", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:ddddc9d4-a302-5eb5-af97-371820cf8df7", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e881f2d0-3bd3-5a44-9e82-d11f0cec8e95", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e34d5d0b-4c1a-5c7c-9e90-785356a9576f", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:49852d6a-3238-5785-a0dc-b82c11d15299", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-test." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.3.39-tuxcare.17" } ] }