{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cf777cae-92fa-5112-94a7-bef607383767", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f3c52cce-d810-599d-8084-4ccf79437bfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:97edfc2c-8c53-5a9e-b21b-3f0814114137", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:efee6b6d-6f74-5ce4-8c95-ca7e835d4e98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:20503aba-8790-5568-a418-c4bf182975d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1d8eaa7b-bf59-51d9-a866-45dc449a5f0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bd0e4dcc-fb0c-5fa8-ab1e-c00150c1b23a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4f4231f3-6382-5cfc-a417-8e95290156a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6382218e-478a-5d6e-9065-fb1f2563a6d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2b7ba0dc-102d-588f-9625-fadc6c5ef62f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:25fbe5c6-6369-5130-8a07-94520a41c2d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f96198f0-7967-5156-99d2-4c225cf1ca10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f4a19294-b779-5781-846d-cb4a580ef1e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:605b331d-1b6f-573a-b755-4416e9a8409b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a4547583-fd78-5b0b-b687-86c1e038c008", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:56b00600-4fe0-5301-b3cf-421c796bc061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3f11d525-9475-5bb0-a279-a1f6fc61407e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5a4c3715-3343-50d9-817a-659bc76b7515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:41c8fbbc-c2b0-5e38-aef7-644d20263bb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:85efa46b-b25e-5917-a91c-a9cbad355ee1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1e663db4-c513-5fbb-b0ab-c8b30466d1ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-jcl. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8cedf485-b432-57fe-bb3e-821365d843a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2cd9cebf-e029-5e18-b5e2-d64aef97ffb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f5f88fa0-8815-524e-86c5-00040210cd16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9cba1779-91b1-5c06-8987-7aafa90c04a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2e9c7cc3-7a7b-57c3-94bc-7a05256918eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4e0c7748-e5be-5418-95f1-302e932ba281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:adf79b69-b0a7-5c05-b3a0-4b183f1e4b1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5cc49f7b-b0ab-5f92-a642-5fa0eb0b660d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:07bb4172-c6cc-5311-885b-476130952e34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4b415b85-95a3-5406-b740-baa4289558aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a9e3634c-41c0-5786-bb9f-be6e8258efa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ad092651-de21-59d9-8cc9-cb293f353883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:29852e84-37e7-5534-aa9b-193ea60e7f32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:865a5269-ff65-512d-9317-b341684af018", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4f99b54e-8ebb-5935-9c5b-63a9b22a4c5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a1590cbc-3c46-5f8a-bca8-2c66698c3dcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0c021303-d327-5751-ab72-c9a4086d6fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5fc3c1f1-2959-5fd7-ba86-3e67ab1c7e7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:71c52340-79d1-5e8e-a9a4-61d241b0f54c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-jcl. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:99c0eba1-0481-5d1c-835a-b823bc4d51a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:860235da-c1bc-5d26-b2f8-5d6c968ed02c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d43465a3-b3c8-5631-a38a-270fa0f785ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8ae90570-a9ff-55e3-bc4b-2910dce326ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c5b47b0a-cae7-50ac-a8f2-f2cbf66129b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:25b33d88-2043-52d5-b9b5-631540149bfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:890175db-cfd6-5333-ad63-a11fb718b189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3578d393-3032-57e8-b745-52d993bb389a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b60827ae-49aa-5b65-a15f-a021ca612932", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.12-tuxcare.6" } ] }