{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6962654c-85c1-59fd-9e08-0ad05ed43f99", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4b067fc7-d70a-50cd-af7f-684b55e0e8ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d1b5ad09-6c6e-535a-9307-8ddfbe6f20af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a5ca3559-6f06-5262-bc70-0159ef9ff662", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:de705f08-d79c-548c-b177-c2727181456f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:efdfc023-aafe-52a2-8afc-b265fa13d1f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f3918333-3155-5324-b40c-e26367664194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ca126f9e-3a1d-580e-957c-cfbdc164ba75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9f245859-9aaa-523a-8674-3039de6855f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:69973a6b-591d-5294-bd5f-4b26b35817cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:aeac2746-d3f0-5360-8cc1-1152ce229816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:beda0b6b-d39f-535b-a6cb-9ab6a3f153b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5f093b9d-601e-54da-93ff-e71643cdded1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ee9684d0-d060-59ab-bc7a-e55ba7d2a296", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c494299d-a5f6-5420-b9fb-8c40794b95db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:58471ba7-bb28-54d4-9db1-78a0ee9fe52c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:41a5b623-aecb-5315-8e68-ddb7b5f35631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:16dfed7e-a83c-57f8-ba91-47ac5eaeab49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:89c01976-a031-58ed-aa6a-735ca501d7da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:30733e1d-84cd-5d86-b46e-06936a94a915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4396e582-4326-5919-84b6-8fb72d30b3af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6658620d-0d12-5726-8436-a7015e604fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ff512531-c424-5bf7-8edc-92a36848aae5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6ee5473a-7970-5565-a23e-8c6605ba3a39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c58f492e-b9c4-54d2-8c03-2d4e0a948083", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f2c63464-f8f7-5da4-8cd7-947dece1cb1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a99cc737-cb1a-5e3f-8268-11c2d731ec24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e9c1c52d-f592-5a35-8813-6c86f2a972fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4af9fc06-44e1-5981-9c8f-0eef4af01f15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c3fa015b-3bd0-53da-85ac-cf7ffee10e56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f7f5320f-4b6f-5047-8693-a99ac75557ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ed160338-a96b-50d4-ac06-bedfb0c7ac76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:721217d6-5547-5b85-ae78-9c1bfbfeafe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:47a756d9-696c-5443-80d3-c003bde7e943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bb20f05d-ce71-54d6-a44e-e7914863117d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:87178751-f1c1-598a-bd63-930bb1f6e62c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9b264527-c5a2-56e1-b032-6beaf2809cda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:11af9a80-9619-574c-b199-bb77730ee734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:516c4fc6-a27d-5241-9dae-962552f1a138", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-context-support. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b11aabd5-0773-564c-bc1c-298382038161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0a12f8b6-4648-56dc-8c6e-47c5af877ac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a886092a-1296-5353-a7d4-9220127d33be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:eef1b39d-4dd2-5c39-ac4d-014dd7cbe953", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7634c4b4-80b4-5879-b8bc-7a7e2293f216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:132110e7-b807-511e-8956-91fcae67f481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c0fc3f44-c12a-51c4-827b-fec997820100", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8942647c-200f-534d-9d9a-a74713edade8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b42bb27a-1c4d-5142-9277-7b87cd66ff3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.0.16-tuxcare.11" } ] }