{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c852abe3-feb0-57a6-bbde-3e1e4ab3e5b0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:15c28b02-7100-5a46-8b7e-1e319085e142", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c86c307e-0be1-5130-acaa-bd62f8a89b3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1fefd125-1793-5f35-9012-97286df9449c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a2b66c05-5964-52ee-9ab2-cb74e885f476", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:423fe513-9fbb-52ed-89f1-36a86db23441", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a6cc6c1e-8c9f-5e9b-8856-1146bdfed494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bdcc5b73-7f65-526b-b87b-f26617cb06d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:af8cdb47-1760-5f50-bc24-3b685aecc96e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ac932b5f-63b5-5145-a5a8-c2160284d251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:698cd8f6-2c59-577b-8107-2d952fd2a04f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:695e7b86-2f6b-5f39-b906-74fdbbe5def5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:71941b1c-67de-576d-a105-6431295003a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d6c0a8ee-51a2-5b93-9854-c49e6c5e62fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1fed6ba2-46fd-5b8b-8129-d793655b7de6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d814f409-6812-5d5a-bdc3-5d0423c9cb22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a18b9ede-6258-5df4-9c8e-88cbbaf619a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1d2e72bc-266a-5244-8aad-d547aa2ce7a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a6d3ee75-4018-58c8-b397-34fad156f47a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4f34cb50-9e76-54cf-91c8-ab965a1ce91f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8ab200f0-0d88-5a44-982c-2d3d917ee351", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:93006f28-2e0d-58e0-9ac2-6ad3f5b48f33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:80aa7781-85ee-5778-b2d5-6a74b6f50b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:471e9bd4-31a6-5cee-95a4-0139cc2fce35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:02dad654-dac6-549a-a78e-b2b69e3afa5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a38f2625-b31a-5c90-9614-49eecb06f9a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e3b5cd7e-2709-51d6-abb5-ab8d53cf1596", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a6ae0eb7-15c6-5b45-bed6-2b71110b4790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:003f43ab-3366-57f1-9e92-a7a7bb425e7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2a6584bb-2a4e-5161-9211-61095a689947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:91e4270e-b8d0-5555-822f-3f5cabed495b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b4c64541-c1e4-5bce-885b-3b6591036629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4671fe71-ca93-5ecd-ad35-a33e4d76e7b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6bf8d36c-8a5f-5d6a-a16a-5899d874a75f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a1c3c5d1-2e4b-50ed-8933-4722df366ab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cdd3a80a-26ae-5022-ab28-61a7ccf747a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:02932fed-cad6-5cfe-88b8-4d8edcc9d84b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e07e4ab8-c8ee-5b71-b386-3cfb2128552b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:96792b0b-efbd-50bd-a431-8ac9931ed010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a82e532d-6cce-51aa-b844-08a36d3c9863", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:60aa2d1d-72a7-5bdd-bffc-d4dc1cc8dab3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:75cac0f3-aa34-565b-8f01-f6e4efb98fee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c6b93830-00bf-55db-a0fe-52884f5dd8f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:796d02d4-d7ab-5c91-9732-f425b1ec9701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0b3d7dbe-6996-5c2e-8f89-f942700908f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9a8ffc90-b9fa-5a2d-9769-e03b1c8f71d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1e98347d-9008-5d9d-9527-0c53a4709f5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cdf1bcbd-7aa0-561f-8460-fd5ebcf686b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:af072c5c-b96b-5997-838a-09cd30c9f2f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.12-tuxcare.6" } ] }