{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec784717-428d-5315-8ff6-ca72162334c2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5a6f9267-d6bb-5113-96d2-426def58d680", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:021940a3-b04a-5d6f-9831-1faf92aed679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f6e60303-4ced-5761-9bf8-dcd80497572c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:dda0245b-bf89-5c58-816b-ae4215154e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ad7f9564-54c2-5f4a-a033-241c72f0e8bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b75c429f-67e8-50f1-b364-bbc9b0b7be56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:31c9be71-edc6-58a4-9d48-c6af0cb5cec2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8c8e7759-0223-5cb3-90ee-11463a69d2da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:60ca06c9-753e-57c0-a2e6-708f43a043ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c2e1b0c2-c4f3-5339-a7fd-7ac38f9361dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2b28aa75-f48e-55fb-8d2b-a252aa9a582f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:34aacc8c-ef5c-5ab1-af93-a0ad4d617cb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8f8d8078-b4ef-50b4-9d72-5ecbf9bb95ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:eb70e6ce-944d-5179-84ea-0e79daf709c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:40663f32-5f9a-56c4-9a3f-1d3cfb7ebe44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7573bd75-a877-5afc-a459-7a3c4e532be6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:172ad8c4-e349-5725-9b70-ec82f3e9eb48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6ceda8ba-add6-539d-adc7-68366a9a998e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:21a378c4-1389-5b3d-9d3a-1c74994355e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5a86d53b-a35f-5a94-af3e-05a15ebbd180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ca936318-b4a2-5e59-bc08-e59075c0b935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b0bd1b37-3fa4-5e94-83e5-629dc97f027e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2f959fa5-d2e4-5f10-9deb-ba1545ab96a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7a2d1972-fe8c-5598-9e31-778350b6b0c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4c372b94-79d4-55cd-80d5-63ac2d7190f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9ecc7ddd-2957-55f6-9b68-39444fd7d694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a499192e-059c-536c-b3c6-b89f7173a923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:962e91d0-4bc2-5c2b-841d-5f955423229b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5e0bb03a-61ab-5517-b6b0-eb111fcecb1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:eccb43b9-bf7b-5854-b954-474c7f4d9ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8d0fa0e2-ce6b-582a-9aef-ecb0101dd79a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:212bb4b6-c2d9-53db-9c88-111fb7c78274", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-aop. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4f503fbf-af8e-5301-afcf-fdcadfa9762c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f3b52950-ed05-54b8-97c0-4680318db4ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2343d10c-dd56-5445-bc29-cf62da41cff1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:68b6dee9-4f90-51ae-9289-34d3ca696168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2e2ede87-9fd5-5549-9b0a-fb8bf3e01ded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:315a104f-0a42-58ba-9ab3-223dece0cc7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a92c9ce7-34e4-523a-8cd3-ef911c66fcf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0b8ec981-d09b-56c6-b65c-017f5f390020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b1e13001-5417-58cb-aa71-b9a0f6f98aab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.19-tuxcare.6" } ] }