{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c02a0af4-b588-56be-941c-e96f7555bf41", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:32852775-b813-584e-aede-174f517bc547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5dd77054-7a16-5ceb-8466-c0a0119bfde7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:4e92688b-51d3-57ea-a455-3a5ceeed8514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:4ba51bec-13f7-53b1-b921-0260d61384af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:303cf190-d228-5298-90cd-7260c0cf3465", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:18587498-1a81-54c9-8b5c-255859848a93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7c32a5ef-502f-51a7-8639-6066af1e1bf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:22c15926-438c-5681-834b-22ef72d84324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:39513b71-353f-55b7-aa7b-fa901addc935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8af117c9-e04b-59ac-987a-9269bac5e8d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7b78f78d-0f10-5bdf-abda-1d307675c9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:07461c5c-cc76-5482-8d53-ed6a978ade9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c46540d9-84b7-5f6a-8fb6-2c37176677e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7c68913c-0212-5ad0-a675-e895b270ef07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:83ad14a4-ff05-5115-9378-dce8533ea337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:da41752e-0dbe-5c15-8ab9-0333dd7cfb4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8fce2164-7f2e-53d0-81bd-617342a67b70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c0fcdd1a-3a06-5c57-999c-9a99e0963277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3f686844-7e05-5480-8897-5a886bcb74d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ad1949a3-6ca2-5fc9-9b44-fa1e961cbb8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cf52ac47-66cc-5b5f-a07f-c590583f4b3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:99dd1c18-643d-544b-9040-6f4f7a7b5b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9407223f-6bac-5d29-be92-c63b765bc854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1ce62bd8-cc45-5059-a939-09dbe3dc2b0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0673ebc0-566f-5eb9-9053-93f24c5f17a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c099e18a-f31f-54a2-bd67-3398b828b907", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d973763f-db4a-54dc-9ec3-86d4f940a3a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c46254f1-abc0-55df-ad08-0c1ffeb056f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8a2dc0e9-af41-5906-9f2c-03b8d7ef8eed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6bb1f32a-a40e-5abf-a171-76d5e25e9995", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3baa9545-ba10-59ad-a2dd-0858277800a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:63b7efc4-594a-58d1-ac26-64958f6f3f2b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-aop. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e91a6bd8-c99c-57da-b375-4ebf7f2d4927", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1b3faf33-48e8-5199-95ae-ed00f2a78bb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7287068a-297d-5eab-947f-1a61af828846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c35e1d19-d501-54b1-8859-3dffeb500f15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:839e6263-d32c-528d-8b64-1b42340e1ec8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5eb26726-038a-5959-ae72-7fa073fb9c68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1b5c72ab-57e1-5935-b08f-c4097366c1da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:172fb195-88e3-5c05-ae8f-3deaafb08299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5b793acf-8ec8-53dc-9f51-49187852cc60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.15-tuxcare.6" } ] }