{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:60a49e99-0597-5d20-bf9a-ef0f5bc2f3ef", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6cba495e-2ea3-54ee-9672-d872ae84bf0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:649c0fab-5453-503f-b8ef-2ad1a0ed913c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:15b6a242-4e68-5c32-ad68-15a1993d474e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a26aae5f-912a-55c1-a80d-489dfe2030f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2354e758-c330-5e14-8e1d-0a40db114146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:446830db-3c51-55fd-9f8d-eeeee199c0f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3cb2236e-c41c-598c-81d5-61065d6a2029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9ee13374-b3a3-5c8e-8613-342a8e076a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:da60a038-5454-5a69-972d-e40045edfad4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e8e4ea82-52f6-5273-a2d8-8b5f8b329d81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:57c80730-5a1a-59d2-9684-71fbc101bef7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3afac639-92f4-5568-97a6-a5729015221d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3ac04540-c416-588f-a3f3-f9f94b3dea55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5a4c965b-32dc-5f9b-9c21-e8d725d4be04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3fbe6466-3210-507b-b178-8b9771ed40a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c73bd205-5e63-53a7-bf1b-2c31ff386e8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fc63e53b-c32c-5244-840c-5ad7227dd8f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:95ffcd41-6783-564b-a197-dc54d92006d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d60d2e56-68b3-5c53-8df8-f078e339beda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6fef8d21-90e6-5dfc-813b-be662533a562", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e769d7bf-bce4-575d-96ee-c676d1573a16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f4b66ec1-2c2e-5013-9af4-70a8826d21c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:da7dab98-cc2b-552e-b09a-dadfafaa6599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a7592401-0565-5fc9-ab41-a3a188835ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b09cf06b-dedb-56e4-a407-f5974a5c5ff8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ee192b4d-29d0-5e7e-986c-e2cf73d30171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bb159fff-72e4-55eb-85fc-3a0de699086b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:511cc311-6dd9-5d42-8c1a-792fae4097e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0e47271f-8261-5575-b7c9-9a3553fe3f81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a58c3ba2-6c3d-5941-85d4-0d1d620c385c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:04128667-9b8e-5f8f-a465-830b26d611e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fd3d2969-6a06-5eb5-a255-9fd42a1ef7ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e954dfcf-7e8a-5198-952c-7a5b231854b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1821f407-4c6b-58c0-8ffc-2d5bde5f7f28", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-beans. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:017cb97a-76ae-5ed4-98d3-590e5d206922", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:483e1759-b6ed-5b49-85f2-27a45174ebe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:824d98c0-951b-50ac-90f9-b71e81dc5c99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4a0cd139-def2-5a94-8bd9-4a983c95e737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:40efc5f7-5da0-5b4a-8697-e453b3307c7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0326906e-9e2a-50e4-9e6a-7f7f696431c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:697453b4-5400-52e0-837f-fb4b526fb4c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b6c66f8a-5acb-58ed-b863-ecb944db4551", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6ced6d5d-b39f-5ff7-8ec7-480bc64360c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.0.23-tuxcare.11" } ] }