{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c31e2a04-dda0-5a79-bb07-2511fa13e886", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:252da19b-fbe7-57fe-bf70-de9d9293b701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e07a4c5d-d918-5a04-98ae-6150fa45c33f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7e1e5a97-ae1b-5315-a85a-0da48021efbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:28194ceb-0b40-55cd-ac70-6db3d2523dd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c1c6652a-c987-56aa-8e20-2b633fcda404", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c70b283f-6437-573a-85fe-749b0dd07cc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6d37b3a5-52f7-5b41-bfcc-cc1bbd338cfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6b6a9e9f-2f9a-59b6-8ab5-4762ec67b92d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:041ce291-17ac-565b-bd42-ef9af0518ad0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dd3e1692-5122-5781-998c-a5c835efa036", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e1729dce-073e-58b1-8408-42497299ecfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cc2ef259-eeab-565b-a681-1f1d6e00a5d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9bbb8020-7bab-5c0a-ab30-726d279aae05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:364febdb-4600-5a68-b81a-357169931c5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2ce6892f-62ab-5b27-9dfe-6ca2e3e0b1a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7abba12a-87f3-57df-ab19-fcad7f365309", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9c2edd7a-625d-5b75-8634-dc147c2ff0b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c4ece82f-dc18-5f85-83a6-62f3545aa68c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:20e97ee2-2e85-5b0e-967b-2b2f1ca89c81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c2f50a72-2538-5023-a084-9aaae26326a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:407b4600-de65-5b7e-abeb-b607e31e9af1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c2a6077e-30d1-50f1-88d4-32a19d13682a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:83c8997e-40ef-549a-a64a-f87930ce672f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1ac2b5ed-94e9-5f92-a26f-4d87692af8b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:612a662d-a046-5316-b9fb-a25a4b8f952c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1c4e12c7-e9fa-53ee-8ba1-a0e5d6089988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:80871f4c-08f3-5cb1-9e6c-4e485cd4505f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:951a1e4b-52bb-508e-9a1e-9f3b92bc96f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1d84ff19-e286-58bf-b580-6207125eed83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bf016b54-76aa-51c4-9405-e31407254dd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ac5c2a66-2c57-5da0-a366-e79caa4b441f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:54af0b1c-2e0c-5522-9334-48ce7d006eb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c31abdfd-56ee-57a5-9881-6e0ae2e4b671", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ed1f3bd5-4105-59f3-98d9-980c4e35fe06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5d100490-c01e-5535-a9a3-f75b30ea2156", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4af82bd5-2104-5ca0-b6d3-88f8145e9589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:65f9428e-4722-5919-87d7-a4e8d43cb194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a650d646-cb22-5ed2-a0f3-efccfbf7d743", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-jcl. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:275035da-b246-5fbc-8956-c6787df2d456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:91d2db20-0e58-5da2-8587-3f9eb1fd22ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:32af42be-e694-5cf2-bbd7-5d50e1593f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:631f0cfb-147c-590f-befd-28a82c54d63d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d8a7d7f1-69d9-5be7-8e8a-f5567412022e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4de78962-4961-5cb8-b940-97f050a766a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bb894e89-e621-5989-abc1-e46ab4159f1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:344cfe7e-d411-5bb8-b2cd-4ab1268fa397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:66739e86-0c2a-55c4-a834-0f7c70da31b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.0.16-tuxcare.11" } ] }