{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:26bd486b-1cdc-5ee3-8118-578d566e4ce1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:495f707f-7dc9-5a1b-8c1b-8c4d45c58593", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d3cf248e-adbe-5205-b09a-c9ae17fa103e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:eae70a3a-1582-56dd-89c1-9764e14a743e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:de7f8b2d-309b-5d18-8ee8-5eb2f945b408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c4f75f1e-e516-5e65-845a-a04b1245600d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4156c309-ab48-5124-a0be-1226f00fb91e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0a1aa968-e519-515f-9608-b25f1f9159f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8c2d9f54-ce75-52a9-ad25-22f73ef6ebff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a8dc0b92-902d-5f85-bb07-d52d976484b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:87b49a37-7fe3-5708-90cd-f8cd7b91e61b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e2749469-353d-52ed-957e-25e9200de24a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ea229591-3c3b-55df-addd-74e551de817c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d5b008c6-1d30-534e-92e1-a518421cd95e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6cc31e87-defd-5c6c-9193-94de7d70b947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cb217045-9e60-5d34-bd3f-bef9693b9bd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0012c04e-9e35-5a8b-8180-d3100b066b5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:83e39a3f-d331-58a8-ad82-393c8a97644b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9ae14de9-cfdf-5633-b5c0-6d29fd3c80b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:86df7b2c-0ac9-50d1-93c6-bdadeea68f62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5f367ac9-0cf0-5de2-a68e-89182a019a37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:436c848e-db22-5c55-98ab-8a6f99e0b58b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:650d5802-bf1f-5431-b8fa-54302787400c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a14b2d67-d7cd-5ce7-a2a6-61b8da52ac4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b022f978-590b-5897-a683-1faa712694fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:07012596-4917-5f16-a1c9-29cd8e948a39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:835351bb-7d0b-53a5-a799-5df361d1f0a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4668ad74-374d-573d-b79d-96253fb082c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2a8699b2-9fa9-5c0d-9988-2c5cd01e5e07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:36b20523-8067-5874-b74c-72b85119abcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:11bed69d-66ce-5c80-b192-8943d5edd399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cf4f10d9-d65c-52b7-bc67-9c478a431e68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ca0498fa-e376-56fc-b5f2-115bfd663f93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6eb5a5bb-9c2d-5b97-9e08-34bcff757f57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f500eee7-da6f-5bbe-8f7e-502334132578", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c8e5c1e3-9a0d-53d7-93c6-dec44f644c6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:40ec2ebc-bf94-5327-9943-2378375da171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c714daad-db86-5bab-a2ce-eb8131abb111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4c4ef05d-7343-5ab9-8804-2f4a8fd0d58c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:77e329f7-4d4d-56b5-94c4-e7b86683f493", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-jcl. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e57dce6a-6d53-59ec-b7bc-e736bfc8f849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b616eb99-5081-59dd-9def-d618025d7196", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bb8ee36e-b6f0-5a74-8de1-752ffc1f50d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:14ef9bbd-3aee-5a6b-a25c-7e5255428bd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:93259017-542b-572d-817b-38566ad56873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e65b07a7-a446-5f4e-9a27-b773df42150f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:773849ef-486c-56f7-a37e-c168e6a99b88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a06313b4-b46b-5a9f-8b18-db0fe655f845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a14f5303-4639-525c-86c9-0242166be903", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.11-tuxcare.6" } ] }