{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:78b1c1e2-c1f9-5768-9b21-52b1174fb463", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f877afa5-3270-5e07-9bcf-d55c2fbe9fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4f92e3a6-2fe1-53a8-9009-63be67acb64b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bb654f73-9ac7-59f5-9c31-6d015c7a7027", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fcc15847-ef3b-5f66-85f8-c83ecd20cb30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d1adb197-e180-502c-8dec-a6aab110c43f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:23a09bb1-caf0-5ee0-99b0-0b473becc74b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2657fa66-65ba-5fee-a027-00f1b746cb35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5d2aa8b7-d632-59a0-9ff7-c5dd6f5c4506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:736b9339-30f3-52e8-a57a-1a2be36ee790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c58e6ace-5bfc-5a1a-ba56-dec1eacded20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e8cf6c20-bacd-57d8-b13d-7790ea8ab43a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:43cbeff7-d7cb-5475-8452-7eef304ad125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1b1753ba-4d72-5204-ae95-8ba4e8f7f930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:01ce7818-78d2-5e1f-89ac-c7fa1a284b16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:eff26bfe-e5f3-5e57-b943-b98ba1f79d57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dd3291cb-cec3-5c0f-b3c8-b64b20a0abb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:aa7a1082-5b4d-59d9-b840-81d2cac8e87f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3f5442e7-7326-5f9f-b70e-ab7f555ac966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5d2299d0-b941-5097-acbf-d94dc8deb8ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fc107644-7b3d-5405-b017-bff95b09a5fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d9352c85-aca4-5fd6-beea-d7a1589ee122", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a9eedfb6-126e-53fe-a7bd-2ae1493c738e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9d29bdb4-b378-5599-bcc1-3b5a5cd47c52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:26da3af8-948a-53e8-b751-9ec5f1d6db36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:81f926d2-0d8f-51e7-a912-211fed908112", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d67519ec-02d0-52d8-b072-656022f93414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:deeef7b2-ea48-51fb-a4c5-1738e80b9219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:590961c1-d5e5-526b-abb7-13a9b220176a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:60830818-6974-5aa7-9009-a0f213257cb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c4d67da7-b808-5a6a-916a-b6d9a946d840", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2935b314-f579-5bc8-8cb2-5da69cd6ce9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:813fc08b-20df-53fe-aeb1-50b326a2c91b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b3bd0835-2090-5543-b963-d2823576a56a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a4d3eb6c-9e91-52a1-8ab9-d6c0e3554e55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f4658d0e-7fc7-5e01-8212-6f20106ccf04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:469b5e90-5594-55a0-a86b-8902d7cd7bac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6b5c0e9a-2c4d-5328-8a8c-e787c3a0179c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2acf39b9-38b7-5544-b710-361680d01fca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-aop. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b777f023-1ec2-57bd-98f7-a9b9bd65a053", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6077f199-a8a3-5f75-9f79-86fec96903c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3db2940a-3c92-5f32-90cf-7025d364f625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dd3d2891-8703-5ab5-845c-afff0c5b2e02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:361bc1bc-3c81-5bde-a83f-b4c2f082a08a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:18442178-9f73-570d-a013-e48e28bc4150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c0789f36-9148-5d69-b781-f892d7cd9f04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2d2c421b-d058-5e4c-b439-364d1205e579", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a8870521-06c5-5c25-bf40-347e0df5eaad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.16-tuxcare.11" } ] }