{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dcfef52d-deee-554f-8056-27f0e2154ce2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:54d9253a-cbdb-558b-9d12-5fe20859ee13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:00acb905-4b39-586d-a31d-9dde965ad49e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:198cfa2b-a958-5e32-8fc1-f0afebbbe0e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1110af6b-a704-5d6f-9754-b8979c44b4b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9507ad76-a6ae-5042-a4c2-e3b78f748fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b66d6e22-9400-5dfd-b236-74032ae9925d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:53f9accb-fa1e-5e75-93c2-a64c4bee1cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cdafc1e7-6136-5f04-ab61-9b24d2ce6c2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5e34ba36-1010-5a04-baac-d918908c9cf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5a5f57c9-b153-59e5-b847-6947043a4a53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:039329dc-8e13-5636-aad1-ac24a0183e49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a991ab23-4889-5ec1-acae-4163820e1f9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5dce8be6-5c5d-597c-a563-9161e0094add", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a858bc00-4b6c-5731-a703-2b6b42bb7416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7e9071f3-1e62-5284-a5fc-53e3d36f3bb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0f0678a5-8cad-5e80-aba7-6ba8114f4254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e65b9336-157f-53a2-8a5f-5d64e2449a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f33bee98-cd1c-5b84-b59f-b6fb947e34c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1d7dcc41-26f3-5113-98e7-6bdf9aebdd15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cf3cccb3-48fb-5906-96ba-54f612bf238f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-support. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4094dc79-fe3e-50d3-995b-63d605b97752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:18b0daa6-4b97-5067-b8de-4059b8e42089", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d537ebd8-5478-5084-bbab-a257ed0f8418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:af792e8d-b2b8-5971-a9ee-80fa897ecb8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:af3e7cd1-76be-56ee-a463-af725507e0e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f93179cf-8543-5036-9972-1ce429449c89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a750b66f-782c-571a-af58-80e83868c55a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:dbcc98e7-feee-52e0-a7a9-a4f364f47291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c8000e23-6aa3-58a0-99d0-fd641e55b042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:26bdc39b-5a0a-59f1-b0f8-d0f45694a3ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a4e90506-df88-5017-8c39-85a76fdfc19a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5d7c9fb3-3034-5809-bd36-4364f4d836b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:21ee766e-2570-56c9-a448-cd6185b9c2d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7bb347a4-041a-5432-9847-98873a1fa923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d6f993e0-ecd8-5f12-8971-e175129e2f55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:40f8c7c2-2d5e-54f8-8f8a-cc2564232570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:298abe82-30c0-54d3-857e-4d48a431e5b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:43ab735b-e2bc-5cdf-93a9-b604c2fb0060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6f247859-cc86-515b-99e9-9bfe6b463c8f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-support. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e916b8a7-a559-5782-adca-a7f692a7f48c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7fe1b97d-b320-5a7f-bf10-588fdb688021", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2f4dd629-d556-56f5-9ccd-a29d4a4dcf41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bc8ab890-c0b6-5ae3-8d77-e7fc121e5fa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0fc9bb73-b2a6-5040-9385-3cd15b2980cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:442a780d-7b08-59ad-a49b-6b5325d5dbb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:32d21755-8226-5ee5-9067-82b33efd4a14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8e10381d-5361-55d3-9921-8c2a03951d85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:53e25317-d587-5ea3-8780-076e7e52ba95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.12-tuxcare.6" } ] }