{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:502ce50d-f3b0-57df-a6c7-e6f2d6ee91a4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-web", "version": "5.3.37-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:00a53448-9e88-5921-833b-adf2f175cfc4", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d71a739f-dc2d-5044-8fb5-5bef3b4e6f50", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1d703e64-b2fe-55d9-b047-e70201884b3a", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d0f509b4-884c-549e-89a5-d628d1c7f0bf", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5a09e9c8-dfff-570b-a634-a4ddd6e612ac", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6f92126e-cf83-5cef-8a12-1a3a1609666e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6f9170a3-d8cc-5457-96c0-737e12bdcbe6", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da473c21-7660-51f5-93e5-7ec3fefb089c", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f32fea3a-cd68-55c3-b043-0ee473588e34", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d715993f-81ca-5535-a784-b25de9d874da", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dfa3f34a-ebfa-541b-bd31-19ba2d254905", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a6b59638-b269-5b84-9757-cc5d630769fd", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7da8b3ec-777b-5ae1-812b-30501e5222c3", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f8a9065-63f9-5119-b7c6-c63bf7a378e7", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9fee0055-7fb0-5581-b97f-4904919f9efc", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:90a05be0-6e7f-5aa5-b230-b0030677165b", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:790136cf-2ff8-57bf-a763-fff07f0caa94", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:91dab8ae-3e5c-5ea0-8e70-2f3e99d0e622", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5798b396-a6fe-5b62-bfb1-7984e90e4364", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.3 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:445b833b-1425-5715-a2a0-62a1f6a2df3e", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a16dca72-7dd6-5a49-ba0d-e256b946c8cd", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8008980c-6ec4-54b0-a929-dfac023efe7e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b5da597a-9dd1-5377-bacd-2de70d5b0dd7", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:febcb3db-6909-5aad-bb2d-7cef6576a9c2", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a191a2a2-b981-5719-8f04-f31d28a71e85", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6d41b7f9-7760-5210-a2c0-134550b305ec", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aa427365-1e33-5330-9ea2-ccbcb3e2fa74", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9839907-8c99-5aab-9beb-6a32a700579e", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.3 of org.springframework:spring-web. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ea4dfc7c-2db8-56ae-b0a8-1de5bcfbc88c", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2599b2a4-76d2-5743-834c-9ee1801dcb93", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d11fdf10-0347-5023-a447-5b05fd370e6f", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aa56a5b2-ef94-5fcd-bfef-3f990cb818b3", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a19aa144-c9ea-565a-b45d-0a70268e3ef8", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.3 of org.springframework:spring-web." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.37-tuxcare.3" } ] }