{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f20b9bd2-f567-5473-8e83-7b696b00b4f4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e22641ce-9262-5df1-a99a-bbdc95b9e422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:00915def-22a6-5f7a-9b0b-7c501a865edd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d79e1200-cddc-565a-a607-d057beb5e866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:38bcb7aa-6bca-5a01-ad51-4be535ea5364", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:131dfc40-526c-548e-8358-79a0a7070153", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:56de1c3b-a3d2-5129-9829-1d9ef24adea5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2550ef8e-2d85-5e01-8ba1-583095160674", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ebc56fbe-8e77-5534-a9fb-a280940e282f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e5c23666-ff01-546e-8a0c-67b5022685e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e1ec92aa-cdd2-59af-b362-8048345b33cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:52a1f5da-75ab-56ba-9843-9a06723b8743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d5f2d7f8-d00b-5261-b047-51e468999b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7da323ca-9e94-53ae-a5e3-defcc4cb4288", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cb0133fe-a0a1-516c-8fd6-8f712bfc5f86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f6d5f12d-c65f-5601-8c26-1385686def01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cd722fb4-9921-53dc-83ae-927476a60335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:24b34368-3ca5-5657-a49a-5b5594a099c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3b148d19-3b96-5a8b-9540-2c82ab3685cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:4eb93ab9-18dd-5ed3-ad39-ee2faaecdd46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e2d7bafc-e3c9-5afb-b458-cae458d0f6ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f6b9e1e1-00ad-5103-abe0-5b3de114b1df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cdaccd5e-785a-5e61-acb5-0ade19a66d2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cafdece8-33c7-5f17-af52-445cdcca0178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b84134d2-810a-5111-8727-227d3c84465a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:da00e970-3e0a-5421-81d2-6bebde3a9017", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9f249b68-de77-56cc-82c5-f040a5d5fca5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b31d5830-e4ee-5eab-9ce8-d77ee79640e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0f4f7a5d-86ce-56f1-8fce-a8b24cb84eb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:007fdd6a-c8b9-542b-a4de-1e413904b77a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:75cbf939-62ed-5791-8d69-d09af56c1e86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:54932436-8b9e-51e3-8e9c-6e6abaa6abb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:11fcda28-612b-5b1b-9a58-c63dba143497", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5eac0351-cb5c-5421-99f2-54a3de53032b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:96bf3473-8514-5ac1-8606-cdbe42d09f7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f9f6a2ad-0dfa-5589-bd8e-78a901a8bad3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6990fedb-a40d-588f-9913-2f95ef4ea3ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2b24355c-cfee-5e8b-b0a9-22f47a80832d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8f386948-625a-5524-9b3e-3a1cf4d9c8c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:45b43ce6-8cce-5c9c-90f8-d35145f46926", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6345a1da-3938-5e29-abd7-293fc50abfcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7e70f630-ed48-5f64-ad11-1a9183a850eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.15-tuxcare.6" } ] }