{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b10fd01b-e8cf-51a4-a52c-b8228fa31088", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a41091e6-88bf-562f-bc11-831b76fa47ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fc0dc60a-efc6-5912-ba58-dac82150d581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a3ffbb61-a236-59e6-b466-11124012a756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4c445dd5-998d-5673-a2f9-f089405502a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7e9ba963-610c-5d47-b9ad-7e6feb72b009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0104ac14-1854-5281-80f2-ba35e3bdf84b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:67f69cec-9fad-5f10-a291-3e800663e776", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1a1d6c0b-d741-5338-94cf-c4ad43d0e44b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4b00a654-d2fb-52c6-a29e-9f17aed04ce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b49dabe4-2325-5cfd-aa7b-babf5a493126", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:15eb2364-74ad-5579-b12a-477b5a763eaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:94d1a219-7131-556c-971e-5d58aed25b92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:82f575c0-39c5-503d-a83d-b4a0ccc1251b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ce51c3da-ced0-5a04-ab61-bb0f9882927a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e01b9493-453e-5ea1-8df0-1b83ea562e3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:58e6a7fb-e65e-5199-85e4-f31f992b5c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b3a36990-ed22-54c4-bce4-6fa3d158d08e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:608ae22a-1d44-5a2e-8665-9d2ef93ccf39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e3f22ef8-936a-5f2c-bb6e-ee3fd7af670f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e9995864-2945-5438-bb52-eb0f3d344bb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:afce6f20-ee44-523a-b61b-ee8d5c2eb82f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7be553b5-3bdd-5de5-8916-53b25d9cef43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6d7b6323-c5c2-563b-8ec7-a175b74d1408", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:596ca214-57fb-5c20-b306-34fbf318f00f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3fd52ecf-a70c-5e7d-b34a-9d50b8c0a58f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e3c05050-c194-553f-94d0-36b79424fd5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7f852f9b-558a-5410-a2b1-9711627a1ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4820eb0d-c254-5484-96af-a7f3621d5c00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7b8b88c9-9bbb-5a8d-ad09-d6df513d8430", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:eb391836-5375-5265-ad08-3f41423865b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ea7273e7-3b93-5b41-aa4f-fab0358c8113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0f595efe-2ac2-5a68-87f8-3c404c003410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ec616f7a-5ff3-51ab-8638-3f1c8448061e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:34e510e8-75f1-51e7-a91c-60a4e7c8b88e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e4555af8-eb80-5988-b3fd-36e8a9170204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:729021d0-1f9c-5558-800f-83f6ef3f1f99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9d434244-11b4-5a3c-8252-3d2e2f7e30c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:06b0cba3-8e6b-5e57-973d-1a52bc5ed228", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-aop. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:65a79809-76e2-565a-aa97-51b50143105d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c33b73e4-9379-5c87-9ff4-d884cd17447a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:826fe161-73b9-535f-bd6d-f1a1d5f9acc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:88ca39c7-7a16-54f2-8951-38c7da676f6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1759a691-88b3-5f1a-85bc-12fdfee3f9ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ae338200-0932-52b3-aa74-3f16720ee174", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dff5cea4-0206-5610-a447-4caf3bd97b61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fb23615f-43ff-5075-8aef-1f367364a3cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e47aa8bc-2fbc-59c5-a52c-9487a572e4c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.10" } ] }