{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:250fde89-1451-52ff-aba0-14930a6a9530", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:62e9af2a-60fb-5516-a74d-38fb9f336bd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:92d47a0f-515f-5a93-a8da-94f7d76e932a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:df085256-da01-5c01-91a9-4a19fbf7a563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:52cd9b68-553b-58f6-b02f-4ec9790f98a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:aaedf617-d730-5b74-bcbc-4806d0d1a2f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c19167d8-9baa-5cb2-a441-6429346b9248", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fbbe28f6-92f5-5d7f-a2b0-2966574caa4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:168ecc7d-d3a5-5fe7-a521-107200346c5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d66b6488-a293-521a-bc65-bf4a2bbd40a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4e756a68-4f99-54a4-a400-b01c79a6d43d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f6d0105f-aae5-58b9-a417-53038d567432", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b27b2d4a-5bea-5a4b-bf6f-7de04d3b5e45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2c3c6bce-4663-53d6-b47c-60964cc884d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:17b3c39b-e80f-5992-8c01-e3343b1c86c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2c0f77f1-3ae3-57ad-8941-f141e514b73e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c5e0c70d-3a3b-51aa-a46c-94ec933dd2b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0674aa36-6494-502b-97b0-e53d219de25f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:99c09229-1530-5abc-b0f6-4807f4a87290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9e3efd4f-9b1a-544d-943e-ecd672f669db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6580b48b-4f6c-5334-b669-66975458ddcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c4c8ecc6-6cb7-5620-b291-2d837ca0fc71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:07013d85-74f4-52bd-8796-ef789555b207", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:04db7a66-7e34-59eb-9c23-7651ac063cf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5c51874a-35f1-51e4-af6f-8a830b1f7db9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0aa05143-e095-5778-a033-9a49fb534527", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:69dd16f6-a4ba-5160-9978-ee6f7c1d3d50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c6860a08-8e4f-5987-a798-a8217d6b9ad4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bfc2a6fc-e8df-52b5-8aa8-2e7e8a787975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a58d9776-9d38-57c8-812c-408148a5da90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ff0a05e1-3511-54aa-93f3-e154097f047d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5bf5fa37-f5e5-5602-88db-9e9345f95b22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6939b366-6523-5020-9a84-9fdf3d39be7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b7aade0d-644a-51c5-bebf-4e1495bd0cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:49ca46b8-f98a-5af6-856b-927dd2da2867", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b103834f-1031-5cc5-beff-b6d8ffed467a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:86cfde68-f5fa-569b-ad7a-82c7bf2e86ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a1a83964-8643-529f-8571-fdca0ca02c1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c66ad125-7127-5b85-8737-10c36f4a3d16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-beans. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e4feaa21-d958-5e7d-950d-b5af4b835697", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8ea20b96-23c4-5b02-aa6e-d5c010704c22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:95cd5b36-9089-5cd0-81ca-230a8bdba46b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:529e4c7b-4a70-58ec-8676-dafa71029cdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e6c6c5e1-c66a-5595-89a4-33bcce181afa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7d6633f5-2236-557f-b15c-ecfa5f1a4952", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:40ca8053-e310-54fd-ad5f-044868089658", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e0685aed-0a14-55ca-a91d-49db6dac6c0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ebc5b0e4-e223-55de-ae73-77e589ce58d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.10" } ] }