{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1ca8d165-03e1-5e9d-9ffe-d86646edcba7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework-docs", "purl": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "framework-docs", "purl": "pkg:maven/org.springframework/framework-docs@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4d2bab3a-1b73-5ce5-aa6a-c8be729d2563", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:44cb6ca3-fd53-5031-8618-40b2ec9a7fbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:43af288d-49f1-5731-ac74-d96b790bb89a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:de9fc82a-3e43-576d-93da-9a77b5998a40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:85f74ca6-5b38-548a-846b-8ab58f608916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a9134723-ff5f-5398-a3e8-58e82526c576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1c1c80d4-5d8d-538b-96af-3a36470570bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f7fba7ca-a878-54de-b732-b9b30ba1dd43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e11e9ab5-e174-5c73-825e-16da6c62f73f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1f1b088a-6a2a-5555-8493-be1eb5144b07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c3854e8d-87f4-5b83-bea5-ca7521e46fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ec0f9e5f-8cfc-5d08-afa0-3600d20ee9fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8573ae97-d902-5360-83dc-0206728caa61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:46e027ca-c591-5166-b9e1-139227e85e16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:33190601-9bd2-539a-a8c9-042100258e3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:806d5dac-5307-5d02-a13b-7c5047450091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b5bb62f8-5bfb-58c6-8647-d6fa110f42c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:abaccd15-fb2a-5431-a540-ac0be12d6ca0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b3b2beca-9b90-53b3-b47c-360a401b9831", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0bbb32cb-3cfd-5089-8bba-43109ea4bcb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:framework-docs. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:85efdb57-6fa8-5565-8eef-1277af2c260e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3c173409-0a05-5211-89cb-869d11885d4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1f557d37-5573-5c07-aad7-b85a20ed4508", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b2b87cd8-192c-5eeb-892a-3ba88c2fc0f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d92a86ae-1b22-566c-9d98-106846e0bdf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:da0cc5e2-cac0-57c6-9561-4f828a87c4f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0e190acc-b5c0-578f-87d5-c88d4a28ab6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c4257c84-701d-5a9d-bfd7-c27790d2e454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8a85f235-7050-5962-ab8d-6e4b0dbb6817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9dd4bb41-83f4-51fb-8288-88ece02d8c57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:56283d1a-ee35-568d-964e-ccab89d0e1b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9b1a9300-712e-5ad4-bb5e-7fc4e6c63604", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c9bf881a-3768-54a5-8bde-6c91f8db9b0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d20c7781-e3c3-5620-9b1a-b3c7f36a0a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1a7ef431-3f06-5706-ba12-5877a405177c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5bde4c07-27a4-5c47-a79b-48c6c9552d38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b1a403be-29f9-5c19-9546-235896c6ecc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d9c08baa-dcfc-5c7c-96a3-2d0464269894", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ae02b2f3-caa1-589e-be1a-eea967196e0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:framework-docs. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:926f7178-1b6c-5cab-9c5a-9765e43e63c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:360c83cf-4b77-5c82-9a90-371db46a6b24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1eab66d2-fce3-5849-af44-9ce6dbf4597d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1c54a5da-62de-5a2b-a3e0-6d705fa435c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5f6a3ae5-7b0d-5e15-b7ac-9180546baccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:821942c7-c835-5ce8-8989-a0765117d864", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7772d1ab-6d19-5ebe-8dbe-e7fa38288e1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a08b4dd4-3fdf-5be6-94f9-413c9bd95c9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bdac4252-9977-5bde-aee4-14eaad718b12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:framework-docs." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.12-tuxcare.6" } ] }