{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3179a9cf-33ad-5da9-9ff8-b61ea2fcbee5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4dc74fd5-3304-594c-a291-cc7716a96aee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a8dd0258-79fb-5083-b618-ad3cfa349e30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:120cd4db-a976-5097-82b0-d18baf879118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1533358e-3953-5a2a-bf44-a8a00a05ae39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:670f5309-452d-5710-9cca-d14e4a745584", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0401ced8-3b5d-53fc-b35e-7a4af503ca80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:041c2f26-1e55-5f4e-a3e4-b601e7bcf9d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:305f5760-b8f7-5ebc-bef0-3503b272b418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fe8e8428-f6e4-5de7-9895-3293313072ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:286eeaa3-1673-5e45-a4f9-d6a0898ab0b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5bb4fcd7-8eb7-52f8-a32a-4f414ec296a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:804cbd99-47d6-5952-8f0c-d370c9c2455b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bcbaf660-dce5-54e0-844d-e771f7e38a45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c5398970-39cc-55cb-885f-7a291bfc572d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9063090b-cb14-5757-b463-933c08efec27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:256a63c3-d87e-5e90-bcb1-df331168c7b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ead38e5d-105d-5bdf-befa-845688e5e700", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:80f3ca3b-ef8f-5208-8046-e637c67bf3d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0426e1ca-3488-5d25-90cc-1e4c1f493107", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9e0199c5-bf86-58da-9ba5-99caf403b8e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-aop. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:94f401b4-1a36-51e2-ba29-b0e957bb766f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e5267934-c5eb-5f40-a3c8-f0b6329e4f59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fa4364da-49ed-5cb8-8eb0-7c56220d7b23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:24bf05dd-a307-5994-9713-fd1da28c6a94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f7ccf163-3339-586f-b6cc-012d48c31b4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b8ddc5df-3b80-5015-8c87-66915b9c6b8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6b9d7076-8bc3-559d-9660-dbe86e81a307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f1325acd-d435-54a6-953d-0679c67c022a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5f3aa638-099c-5732-af1b-a20656bb5063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:92c75d50-c133-5968-bbe5-b439e2437b11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:18d1077b-cc4c-5f78-bbe2-9eb5b347db43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:554123e0-7921-54d8-92e0-b3cb92f10429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2d364769-b9ad-5bc7-93f0-acf6e54123ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7483b603-0305-5bc4-a8ca-7a9985ae3ee9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3cbdd901-b38f-50aa-8cac-4029d0baff91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:860f3f8c-ad59-5014-8bcb-ad6dde49a5db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0ff76a61-49a8-544f-b2d5-3cd42ed7b95a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:166f40a9-5350-5b99-9d4d-b189131e76c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:dadff139-5edc-55aa-addf-d23f65089bf8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-aop. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1d44e1de-9cb0-5f32-a608-1109e02cd08b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d14cb838-0b19-5bff-bd88-a4fe82f0c95a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ab028363-b68d-5cc7-8539-120fff60bc07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ffe079bf-6308-5c65-a06d-23897c483205", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7fac8708-8e2e-548c-926a-fae685bbf90d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:11e66d24-ee67-5c12-8b6a-8bc527406394", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c994a3c1-a1e0-5adf-af90-b82940e771d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2738f05f-796f-5254-84f8-e687af2a07e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f2789844-e6c2-56b5-9a5c-aaec2560c63d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.12-tuxcare.6" } ] }