{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4f095bdb-f07b-53d9-b218-3054cb2ec76b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:976e2f8d-30bd-54a5-9f84-1b82c34062d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b7eaca74-ca91-5608-911a-6258b4b4383c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f535cdf6-5c30-59c5-83a6-e8ceb21e616d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b5e3abbf-5388-5d87-a441-6a7b4b73a16c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0850cacf-c1c4-5a16-bf89-c8ec12ef31fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:723a1c4f-41bb-55a4-a3e9-42181e38b184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0d35b75b-e5cf-5f50-b089-2ed905dfb8f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:213cdedb-d12b-5f68-9c4c-5c37e87e5087", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:20183622-7906-5068-956d-261fc7184d57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:721c2081-617b-524b-b9b0-6ea4f53b13c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2c7e96ea-0257-527f-b4ae-7d568afe7a2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b03c2591-41fa-5297-8504-5ff4afd10c40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e40288a8-86e9-5300-9f94-1d070ef3ceeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:282e8c32-1ea7-569e-890c-cc3f07a28634", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f2d2dec8-ba46-56a4-b5db-5aecc1265efe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2d1bddc5-1424-536b-9fca-072659436993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e412a27b-e245-5332-9bd3-91242cd44c08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ff5b6b4f-4eb6-51d3-adf0-14a908450cf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4de4a8b2-1822-5975-a815-4d994a707ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e2c2d99c-ab57-536c-9d68-1bfd73d592af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:17c1ebd5-6cb9-5b7b-8054-298f6e6633d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:53d6aea7-1212-57d3-8973-95c68c741832", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4893efb6-23f5-55d3-b37a-05d2b3049fd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c3dbfb7b-8c14-5e5a-9e54-0509ab684e41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:efb6367b-c3b9-5e78-a26a-a4a0cd025527", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dbbca631-726f-585b-bf44-eb8b0393d8a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5c77303c-f5ae-5d51-8bd9-153c2d733fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4990bb53-ef3f-5944-a5a6-fb59ede628c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:19b3d1f2-7594-5bad-97f5-bae891715035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:939661bc-b64a-5df2-a0b4-0f24571b367f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e4b603c1-29a3-554f-9250-5ec08283186e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e5825d6c-16ef-5ba4-99fa-550edea51844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e8dc7952-b1ab-51e3-a45e-d625130fbdd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:85afdd9e-285e-5cf8-b70e-66dae8cae97f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ef316301-77e0-50c0-a6f9-7ee49f00d7ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f12684de-b352-59a8-a470-3ba4bf1bef55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8a02654c-fe77-5c81-8e16-9c3de11b7cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e6eb1afe-4a0f-57b5-9201-4a189b74f3e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-beans. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:94b238c2-64b1-5dde-a749-bac04fb636b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4fdbb2ad-a8ae-58c4-9381-0b303cf461f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b04eac64-a7a8-5948-a446-9bfed02bfa60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dd7ff9d4-a492-562d-92e6-34e67dbf065b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8cdeb820-bef4-5351-8632-4d8fc39b66b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6117ac13-2868-5396-a479-7d9494b7075e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:13901c33-229f-55ed-9b1a-4fbcccc53e2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:43c3877a-4277-5762-82f1-2bed89bc0c85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:87a50b13-bf2e-5099-a24e-428761537c3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.16-tuxcare.11" } ] }