{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:38cbb375-3aee-58b1-aaef-0359fb73ba6c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:37a45a9e-cf4f-5016-a047-6bdc21d252ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3cc9ea46-c085-5877-8745-5c62a853adad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:02ccb4ef-50d7-5559-9410-a99900040c4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1401db6a-572b-57d6-812c-5f500ed36fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d53aab3b-7d92-50e3-98cc-d17541c57b91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d7e5fd82-cbfa-588d-8c1e-215b69676c7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a5e474f9-521b-546e-9f8a-b4a7092c3673", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a5360e69-0eae-5c73-8ebd-cba752f27887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1d8c8dc8-0015-5117-a3a4-11eb55410d5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8e6fb42b-ff79-5363-a4d8-d6c81f586ac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ae783930-5f5e-5edb-a5ae-84389fbcb44d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2ccac971-8aef-55aa-b8de-bf46e45ff07c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2f764939-9735-590f-b6db-8509efc9f2c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:19a4be2d-fe3c-5587-80f2-cf72a8db4cc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:249158e5-65f5-5abc-97b0-26bb6001b978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8d92bfed-29c5-5e52-939f-3d673ea3604c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d0777ff2-9f6c-5f52-9b8b-14146b7a3e50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9dfd207e-ce6f-56ea-b951-b91a887486e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e7d56f23-afea-577e-98cc-83b3a4eda9c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:db131970-f35f-503d-ab06-0a0961e193b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f18cf210-be27-5488-9774-e18b4c491e3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f0c95d77-9365-5e9b-8c7f-75f27575f6b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:395ab8a5-d10a-5ea3-bae0-79b3bf1969e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:339f350c-7e38-51b7-89ca-a70877db3280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c5ae632a-31fc-533e-9f71-261658e42acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:805419fc-fc2f-5ff2-a285-114ebeddbaa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8eb22c51-4c10-599f-9a3a-313b67a9c615", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:800470ba-ff55-55fb-849c-0fc63d99f324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:887640e1-7a10-58c8-8d1e-0bef8a791d0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bc2da3f2-093c-5763-892f-826039e94d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2fd96f80-d6dd-5cfc-b1d4-a0ec3d0f3b4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:228c6c76-4456-5e19-9aa9-dd95b55389b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1b2615fa-faec-5bb8-9272-ade9bb00a8ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b49358af-a7c9-5d73-9fdf-bae3db285780", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f86c987a-d122-56f4-9de5-e9552969adeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8e65e687-7f34-5a29-9e82-d0e0ae88cbc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:08613647-0317-5825-8eff-a66d87826f3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c80f3300-e262-5293-929f-9ccff595eb26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-jcl. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ec87a063-108e-548a-80b8-263ddc92ea74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d85d14a7-8cfa-5b84-8c9e-537d14d88982", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5bfc2574-f395-50da-8597-4b907e36a1b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7b4e41cd-4a54-57d7-aa28-4f6424dd6800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9b6de140-1967-5e3e-997d-eed5e98ee243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:845b4162-5ae6-520a-9f30-d2338363f66a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6be19984-6df7-5512-bd75-2310e767a539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:26632a0a-6683-5e0b-94d0-16f058d98639", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:214119ef-e4c1-55d7-a297-809706944035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.10" } ] }