{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aad7dbd8-8b63-52b6-9ca5-c49d74f127b2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dc931c00-d066-5757-9a74-8ed355199d8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e5732e8c-b8e4-5665-9fbd-68a8bc1a3f6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c61f8087-9d4f-5145-b327-2d016fab23f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:75801522-438b-545b-93eb-f1e897d308ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d284a02d-704a-5200-924c-4f138960e092", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1c933e83-806c-5a78-81c7-2730b5bb3474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a31b7f07-0e2f-5066-8402-8e73b96c57cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d54b0aee-7921-594d-bc01-f3c3e143d396", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a784d32e-6359-5935-a0a1-d156f8f35927", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:54276335-9ccb-5cc2-bfc2-c13b7ee87be2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:93db4e6a-bad8-5187-b981-0b51bd8338c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7a20c6c6-9ba5-5539-98a5-5edbb897776a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:61e73bf0-ff5e-594c-bc94-30a9ac5e4548", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f42e8b48-f030-57b9-9b41-0de9251dd1fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ef34bfcc-423c-55a1-b75c-76150a610d18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:24c78d2a-6820-5388-8078-37054f08eb18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3ae1a445-e73f-5451-95b8-3072ab4c86be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:799ec5e9-50be-51d0-bb7a-7f6ec5235466", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e22bba7b-add0-5ed2-9798-8ad73fbcd526", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:250a8542-8790-5f99-be2f-dd81d1f253b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:608d1d19-6b41-50e6-a4bd-ee9e1e5aa31a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9138c05a-3a3f-55fa-8b1c-b2d1c5f601cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a6de5b41-5144-5e46-a10a-ca9f2339388a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:62c3076a-e80e-5eae-b9e5-061df25e8910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fb258e03-03c1-5f0a-a9b2-fdefe0853935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:96966f96-7868-5859-8b47-5a58b1e8dbdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4947e85e-0500-5177-b536-77fee6a13cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:636cf78c-e4d3-5cff-a2be-a3826ef71dda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:39f19b55-1072-57aa-9e54-f213f7af704a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b872fa6f-2160-5a08-9ce8-de44f2247f18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:996317c3-5679-51ef-9404-db627213c1bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cce5ab30-1281-5e61-868a-52ec7222363a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4376f783-0087-5163-bff9-1870bf6c9319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cea5286e-4937-5a5a-afef-063cde883fdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ee551405-98b7-5202-93e5-497db11e9e15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bdd0b78e-7c8b-5375-af29-929a9b824233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e543aad0-f1cd-541c-bd00-34d342d46295", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:651a2eae-0c34-5d0e-b728-f0e9cb75ddef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-context. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bc8382f1-4f58-57af-8cc0-0601e29f9d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f1a3b58e-8522-5ee2-b6bc-e81c893af1f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b0644c03-0293-518e-9424-ed4ef3431213", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8cc00e6a-49a9-576f-a379-ccab6140b3b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:00bba1bf-5404-5bd2-baf2-4b4842c44e70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:464bfb77-ee30-5744-b8ac-658ec5cc961a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3c12c34d-0df5-5faf-98ba-071812a9e3ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:73b0f8e4-0a5c-5ca3-9a0c-3b7b62162003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e83a71bb-0992-52ff-a06d-1928674631b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@6.0.16-tuxcare.11" } ] }