{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2078a231-2be3-5116-845c-657705f4676f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:babad6c7-940b-555d-8dbb-c066d53d4962", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:de0b4a92-cf31-58a7-843f-4c3b48cd4290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ccd40872-ba1e-55ad-88c5-a06cdc2cc202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cdc2bf74-b6a1-53df-8a97-86abd38494f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3d78f95a-0551-5954-9f8a-fd3b49a1f755", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:67799c57-3c3b-57c2-b97e-3796a4fff47d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:65fdb59c-ed01-5c3c-bc3e-74766b6af41a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:59e4cb80-a8d7-5b92-9d6d-4c38b171a5a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2bf1a1df-c9d0-5e2d-a915-aedb1472fd77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:72aec98b-b5e2-529d-8870-a0e32a8da3a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b97150fa-cfde-5292-b438-9c0b31235c18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:01b1921a-6e65-5c2b-9249-f2581d551412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a880c2a9-5acf-51f4-b7e2-94a5e3cbd4ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5ee6cb86-206c-560e-be4d-c3548d8ab0ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cb35913a-2c0b-5558-9bff-ea47112280cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:44bd1722-5762-5f3d-9d52-7f7c52dfbf48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fbf9749f-976c-58b4-a47e-f5a2fe293374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ebd9b880-5cd4-5c25-a33c-4e0cca309416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ca78e55c-ec38-558f-adbd-6c824a018d8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8baf629c-b716-5d36-8df4-00203a447535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:192ddd6c-f1f7-5c8e-b023-d897d1b6e8b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:be28ffdc-ebe2-5035-b6f5-46a702f23ec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:45e79359-66c3-572f-b083-a03353371063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1a153629-3bf7-508a-86bf-2a588d9a4e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a74bcad1-86be-50e2-8b8f-e733a0bbb407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4a13c925-2022-5dc1-bc8a-8de5f3a7f1e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a4a6bca4-6910-5a92-8e1c-8f51ba46f119", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a5f327b0-40ef-548f-9ba2-4a5f51d8f819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:77037ab9-4444-5ee4-8a9e-9031e3c1e1fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3aecfc60-b232-52de-a0e9-1bdec2f2b214", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:817a592f-f546-53b0-a7ad-2fba1bc4d63a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d9d8d404-f375-54ab-ac8e-cc46338eee1d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:61c059b8-0653-5c0d-af09-230879f576fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:98c06b46-6851-5d32-a0f3-7af455f90f7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:37a04825-3003-53d7-bea1-46f030165470", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9a887bdf-eee2-503e-a9d3-42429a4dcb38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:83c79caa-4cbc-5ae5-beab-0e7e3e33ca31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:db083d3b-959d-5c93-9d25-38c50d4a9da9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:097b10d2-43f4-5906-a76f-cd980a7bc034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:48224a42-0391-52f2-b734-1cfebb705045", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e37703d8-f1bc-5391-b1fa-b1c94501d180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@6.1.19-tuxcare.6" } ] }