{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:487710d5-87f6-5b89-98ba-4e2a334aade8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:80d2f1db-d9e3-5824-8e6b-f8aa7180d581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:600f95df-e2c7-5bd0-8145-fe2cf6cc0204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2fbd587e-958c-58f3-9d4f-963ef44be6a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d195a2f6-0598-5e1e-96eb-e1b4ce0a4fde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3b47dc7f-d489-511f-b392-8117072cdbb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:bb236537-ad17-5549-ae38-5c27019a8626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:15d48a14-1bfa-5712-b5ca-37a2ee3c2916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:168b1f62-73e0-5d0e-9bd3-1084da2c1a07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d559ff71-d3dc-5a52-9e6f-8dc2917a3285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cd3808e9-55e4-5369-a9eb-2e66d06d4a23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7b9bf5af-60a5-5768-926c-10e70a16dcbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:111e26b3-e1e2-57ed-bf63-e22534bd3aad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6fc2a8f9-df2e-5174-9175-6412bf35bd55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d0b5672d-24a7-5725-99ce-25aaeafc6509", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0b5fdbfc-3a57-5462-8443-e1cfa6fc941d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5a4dad47-abf9-564c-b35b-b124890f64f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3daeee8e-6f6d-5636-b05d-0ea366c2ba9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:be4434d4-092f-5a81-a851-4d9ef765f5db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:613a6468-9d40-529c-9f47-6b2494f7395a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f3900912-7712-5789-acd4-cd57effe0c03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c344f691-f64c-52ad-9454-217914cab8b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4f7ce130-923c-5187-9b68-6c16450a47ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:112a51de-0877-5854-a239-93e9da94a8ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f80a6f7c-5d72-5bb6-b2af-b33a5539920f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ea155008-e6fb-54dc-ab22-8855305b8541", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dc6449c3-b912-5662-a649-ad1ed13a6887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e10529c1-036b-5f15-99ae-8217d91cdeb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6adf081d-2065-5893-9b04-2777efa19aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7ef8fc58-eea2-5041-ab46-424432f0a800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8e27abca-28d2-5a81-957f-173c6c1b072f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:62beca50-05b8-5d1b-806b-6391427e255f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9e1fb840-1978-5f54-b037-51fc7fbda16e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:57bccd98-2248-5de5-8a8a-413760938189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7ebf1cb9-0372-5cb3-b5cd-50277e500d22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d2642f05-1d00-527c-beb3-4ef3508c5d60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fb50b8e9-ef29-5519-8348-b3fc34174bc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ccd0193d-91b5-5806-ab78-588d05dd68c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8cbdd144-8922-5c2b-85e8-5f0ebc6b9534", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3a022d5a-ef7a-52ec-b4ab-a7b59fbef7e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9375c476-6a4f-55bb-be78-73ad85e39549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:773bee30-352c-5a3e-b010-209fc895e431", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:218299aa-324d-5ec3-b690-bbe3fa7c0ded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b8133325-c29b-550e-bb65-4a87fef84c2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.0.23-tuxcare.12" } ] }