{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c44f64b2-def8-5977-991e-1c7378279ee9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:918ca9a9-160c-55b8-9f4c-69aa1d70d0ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fc36a980-0cf9-58c3-93aa-1f56826341d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:009ce2a4-8309-5489-ac5d-3bc90f19019f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c0f71831-0152-5ac7-9846-af138a4023eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:68a19e2d-17b0-5320-813e-cebb65abd4d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2adefa7c-cd35-5724-a426-e6e1feafd9a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5f107c3d-b493-5e2d-a490-7b5f1d0a0f74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:27a5e985-98e6-58c1-98b1-020e06ee74c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:30b6aef8-9d85-55a5-8773-dcdae3ed2697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:79a2ab0c-19e8-58bb-9513-d6d2cd7ff5d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b4bcb9fd-5f41-53b6-ac0e-be6c82dfafa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:df7dded7-8307-5d24-a5f0-00ca513b1c30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:31322f9f-8813-50ac-abd6-43690fbaaf02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5f15f633-3ac2-5038-9c94-b5964ec09233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:585cd886-e2c5-5051-beec-27c9dba41574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1873a748-7f81-599e-9113-88ee48b115b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:55a4467c-b0d5-587b-9dff-881026b5b2b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:110e6804-1923-5c74-9249-d22c8ba528ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f4b18fa6-d36e-534b-a38c-7578651b6bcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:70f0dcc8-e80c-58ff-bcba-4526dbdf212c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-aspects. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:df0d9ffa-d5d9-5447-858c-f19f87d80467", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:464208d8-5ba9-5736-b88a-fafd0051e48e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ecc02164-c100-55b0-abf3-d4af341dcc88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a78956f5-d5a6-5a4b-a3b4-6699eedd7aeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7b924202-ae52-5c1b-a294-13ba6f6f70c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6af98d84-0a58-5499-912b-6d5280aa8374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0e72098b-fca5-5c5a-be7e-db7a4ec981bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d9388f25-ed19-5afc-8a94-4c086451b51b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e7f80ab3-238c-5fae-abc4-93371a084d59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8497de78-0e59-5152-999f-dcdd7a293adb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:48822278-f76f-50e3-ad58-443046a3ebee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0846998b-1a16-5dda-bfca-4f64aeb4ab64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1645da40-bc57-580b-bc4a-d979a6b464f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:903bb507-d7b1-5830-8b34-2d763278c870", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1e03405a-2bc6-5135-bc12-f890776ea000", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:178bea5c-0ebc-5c50-bd79-80361a10ac9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:57dbeed1-bf7b-5633-8ad7-5db882348152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f3e500a7-f235-56d8-8226-c0b3d3d7b14a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1ae5f151-675f-5f2b-a73e-8e7cfe016a80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-aspects. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3d6004c5-512d-5ff1-a596-e6370590d68d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f6aa55a0-31a1-579a-be42-0341ccf72629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2ccf89fc-4370-56f7-b2a4-27d9eb100e3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:78c0adff-5812-52f5-a881-b4904df17300", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:77e9059a-9625-5f09-b35a-b02977601059", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:99d01e04-fcee-5e14-b01c-32ac22d1b4f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e6d44e74-a4a9-5a46-af45-6aed5e58c6f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fc45ee94-ae34-5ae0-9e79-511ae82b4b79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5f9ab8f6-aa55-52f1-ab8c-8ecc4a5849e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-aspects." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@6.0.12-tuxcare.6" } ] }