{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e922dbbd-63b4-51b2-bae6-777c75d11030", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e8d6ba0e-fe42-5b5b-94cc-115edc38fbc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:097e49c3-a829-50ba-9128-de053d4861b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:88ae0172-ff62-55d2-83be-810fcff14a3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1ac416e1-ca3b-57e6-a719-6a8a5723ec85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:779bd739-d5d8-5939-ac9c-03749148f2f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:30958c6a-2493-5f37-8cdf-8736ce3f8f8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5d7f42b5-9717-5301-a950-01b7870668b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3abe88ae-f470-520c-8afb-06663fbe8be1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f08eb3fb-6b12-531e-b0ae-3224c2932f10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e2fb0092-bd4d-5a37-86bf-3910c948b335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7fd02f98-2205-5d48-9e93-7bf910d3a8bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1cfde972-593e-576e-9063-d986b8aaf210", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4d44c280-1d10-586f-9e0f-03b3652ce767", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d02b8b64-d1aa-50f0-8863-e10977202821", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3cdd7379-b0c9-5c76-895c-a04eec751964", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ae2a17df-1b57-55b5-aaba-5eb1b7a2292f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d6288a9a-3a1b-5e69-a352-400f2a455a9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1f824cd7-bf86-572d-ba86-a65dd07841b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f5290f1f-d207-5bd8-ac75-0bb8270af227", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3555096b-1f1b-507b-90bd-6063beab09ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9841901e-1b4f-5bb8-8829-e44346bc7db2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ff2bbac2-f1d3-57d9-85ad-ff9490120c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fa1b1ec5-e006-5676-9713-e97cd37ce160", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7fcde7fa-83ae-564e-9b2f-82bd98ebb1d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f2107f68-aacb-548b-ad27-e613ae58ed80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8f0213b2-9a73-556b-8d29-6e980e2c3cf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f731d07d-6a03-51f1-9cfe-dafc5ba300d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:011effcb-e5e4-545b-aa33-150edc8b9a43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4407928b-516e-53b4-bcf3-55052f98d44a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:92c314f3-48ba-5cec-b7b4-f2036c65263f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a6e8daf1-b43c-5a9a-8c59-41eb734b80ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bfa90bb2-72b0-5644-9d6a-f61b91bcb7da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3cf02879-b6b0-5727-8629-b63285b0af87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:428a759e-55e3-5173-97d1-dbde168efa7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:35f1dc52-6924-5ab5-b96d-62c52556edcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:650674ad-1618-5512-95a4-6d2caceed134", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d62d5615-b898-53fc-81a6-de3f540c8a06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:558ea0aa-8a53-52b9-b587-30a1fe8aa2fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-context. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:aed1f86e-45fd-54da-971e-340bd4fe23c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8efb9756-887f-587e-a386-8c4f6b4e8f84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c632f79a-d94a-5018-a489-17f0d963c1c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:469c2bba-037f-54d0-9934-b73bd73e8030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7551e9fc-29eb-5369-8211-402b719c7900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:118092a9-4e26-508a-b411-a8198428a3b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ee2dd959-abf8-540f-8651-26eb238e75e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:725b607d-2105-5152-8c31-b064a45e4768", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f22286a0-011c-55e5-b01e-924585d6df7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.10" } ] }