{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1530295-3325-5548-9778-af46803338c9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:baf842f0-318b-589e-ae9c-d59facba9bd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:92c0568a-dd81-5480-b233-56865f558a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:687663e1-0dd5-5585-b0b5-81e516026da6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e83e97c2-5e93-51ac-8bc6-3a880fe110c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b658af35-3f87-5be8-86b3-62a0ddf89a8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0c3b3023-eed9-5c8c-b7da-54857eb784cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:001e1cb8-df52-5bd4-b13e-d55aa6aa9d3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:347d3847-f0ff-5d78-a74c-5e8a0fb94d8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5b5b024f-5c71-5cb6-a419-1174af76debd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ecbce773-d2dc-5bdd-976f-558c609977c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2972b7ef-258c-5ddc-bb11-a9cc5297dc79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1a2344cf-200b-50cb-a196-b19b33b15c77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b741f4c6-e098-5800-818f-3a5bfeca057b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ae759192-a744-58b3-b2d6-0ea80527b608", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e020bc95-1282-53c2-8261-8335ba0b3c12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e73eb9e1-c943-5073-b791-1d6abf2deec3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:711291e9-69dc-5776-87d2-98f045643bc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:56869bba-ba04-59f1-8445-f86e77336472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:96f91699-77c9-5cad-a7f1-3aff520bcb33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:eb74a090-1de4-57cc-a7aa-96c3e0299e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e12e40e7-3eeb-52bc-a233-530b20431462", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a26c0555-3ed0-5ff1-8b7f-5ea3efe44e28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:98fade2c-c220-58a7-baa3-169ff7e6ece0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b1fdc689-60b2-56f9-a696-40cc7e6952c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:33eb19b8-5492-5b0b-b836-fa6bda1c2271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c401f83b-c761-55e7-a0f8-19b9751695e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b62158d2-7255-5342-81bb-409788f0ecd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7f30b04c-208d-59a8-b091-a56a31b216df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f4173319-50b2-5dba-8d21-50912896a498", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:dbf25ca6-84ee-57e3-883d-b511a47c9bb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ca37bb74-d556-5cab-a4f6-70cb90892323", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b9924456-91bf-549e-9d9b-57a6020a176e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-beans. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:154fed8e-457c-5d50-a2d7-34e134b14d9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:23f75bc3-a4f9-5d50-b7b7-75a45d727c0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:97d7b3e0-8e73-59d0-b77c-bf89e03b5cf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:56824925-5853-5cb6-b5e2-04a2080e97db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0faddf25-8d7c-54bc-9813-0d9541b301c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7b195e8f-8b99-5c50-ac3c-3d64aa761aae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:42d491b2-ae23-57d1-b6a7-9ac4ff291ec8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:990bc7cf-0d29-55fd-8f78-ab7edd35c96b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:459c7983-ddb7-57e0-8e6c-03abcd4bc3c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@6.1.19-tuxcare.6" } ] }