{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:44626581-8307-54aa-8333-75bdda58d451", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f3a07ccc-90ce-5a45-9f1b-dead6870347d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:47a669d8-b548-520d-a1d0-af2aac064ad0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1c661e01-b5e3-552c-8c6c-67814d5dfaf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ed39e2d1-7964-5fcb-97b4-789bfd55bcef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c96d3748-ee6b-50d8-b7e8-314caeacf503", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5bd135e4-51c1-531d-9da6-bd470c72a671", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d00c75f6-d1b3-5c5c-a157-25555dcfd7b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:78d292b3-effb-50ec-96c4-6a0f7622c8ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2e5c9640-41df-5776-aa1f-0323d0c1fd81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:275c30d3-3dd0-5e39-9bc4-a1f7178b1b35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2c13d0b9-9808-59b9-ba35-c791b6d93721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dd20eada-64bb-5dad-9264-6021238e82cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d8c1905e-684f-575c-b681-80e8ad24820a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9520d5be-3e2f-54aa-81de-ec7aaa7f8790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:92750239-daa3-5388-8a4a-8ec4838fb2b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a154042f-1a96-5c4a-b7b3-57b45d8f3029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7cc1b6c0-b30a-5636-8de7-094bccbebea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9b1cdade-43d7-5c94-aaa6-6ece62582bfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4c6926b8-b104-5685-a8ac-192bb01f5937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fd4e800a-8eaa-5314-b9e3-946080eb5398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:52347e6d-dc7f-54e7-bee1-0a7e76fe4fec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7e102966-a5bd-57f9-8085-091911bc8c35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9afc634f-f80e-5da8-90ad-681b44e400a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:16efec70-54b1-50c6-863e-4e7b515548b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:380847ac-57cf-5aa9-813d-d0f1a225c2b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7a6604cd-4558-5881-8cf1-9610d523102e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7b5d86e1-8f5d-50ba-bb13-7eb00473d642", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:acea9492-dcaf-54c0-8ff6-62ab919e4f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:20bd7c60-0cda-5727-a116-d33063a421d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e9c04429-52a4-5cc6-9322-1422b88e8306", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2d6ef7ca-a11b-5072-adb5-c7d550fe27a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6b305b30-8d3f-52d8-a40f-2f88238dcf35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:baa6fbe2-97a5-52b2-b783-dfb65e1ffd6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:947de5fa-e96f-5ff6-b3ce-99d9690b7a91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7768c4eb-41fd-5d4b-991d-6c9a4bdcc8f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5f5478b3-0df1-5c47-a31b-b54ddba07d01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:99c8ee24-bad9-59d5-9f13-16840670c824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8cae6e42-3287-5290-8de0-33d936633c76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3013310c-aebb-51fa-bb4c-5c0545ff46f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0c1f1d33-1567-5af9-9056-e8aadbce0667", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7b215bb7-70a2-521b-8c9b-be89671ba169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6f9fe574-43c2-5fd6-954f-65a0823e237b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ca30f648-760d-5ad8-b73d-e6c45776b5c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d3f69026-c3d5-5778-aac3-10dcd4be5cba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bddd64ec-ae25-5fb1-a0c3-ec093fcaa5d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:483d3a14-c9c8-5aae-9e32-66934f2ae670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1c6081b3-ceb7-518a-9e00-92af5761400e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.16-tuxcare.11" } ] }