{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:da50bc5b-a9ea-5655-b3d1-38f2804fa521", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8ea95792-521b-5077-b588-69ba47c68fd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:60f41a55-89f5-5115-9a4e-787b432e5fe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2abbb5a3-bb92-549f-8843-4136dfc424e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:140f30c9-8489-51c0-9229-714ca1af5927", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e5f0f7f1-32ac-587c-85eb-39971d475f5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:eebd7d0a-b470-52d8-bdc2-1314dd69513a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c64b21d5-17ee-5f6a-bdb4-26cd128ddf17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:064e02ac-af7d-53a2-a270-fb189c1571cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c12234c5-4837-5aae-bf3a-9db5c70bf858", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9a50180d-40dd-5aed-b58c-6a4c6f223424", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7c816ae8-6437-5cca-9f9c-6475fc75984a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1d3c7a1c-5857-50f9-8240-60cabaa48552", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:68f08a7a-610c-5fdf-92ea-c0c5f36d028b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:52032611-31b4-51d6-b881-dbe66981c0fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e995a6df-87ea-5bcc-b3a4-48c71a48d339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8afc4627-0544-5c9d-bc96-8ab2a78890db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:10ec1a7a-a2b3-5f4d-9255-0bbb2a3f3b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9918fdf4-75fd-5fcd-b2e1-bb5b2b4ca239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cf958c3e-e36d-535e-8cc0-8085af63befe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e4e427a3-e105-5dc9-ab6b-5d2b10ed3ee8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:07f03cd8-2d53-5fd5-98cb-728047243c7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:23ac796b-c7ec-5162-918f-6f85be642a12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:622dcc1d-e6f5-55ce-8a75-3fb72d96e21b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c79dce57-3438-504f-a79c-a7af4ca572dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:46bf03e6-f16e-5f07-9388-63ac886a946c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:325c6000-489d-5c32-b52c-9361d30a99bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:50b22923-fd4e-5a88-8de0-4f9a402f7f26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6e36c8d2-8547-5542-8cec-db2719e813f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:27be7fc8-2423-58b4-ae1b-38b9730a5475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e963e8b3-962a-58bb-b89f-996625f5a46b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8f4462c4-4104-5d69-a02d-42bf5de74410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:10381d4f-51d4-5d1e-8631-7533ab0ac823", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-jcl. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c52c740d-8130-5f65-b39c-f41e099f142b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:71cfbf3f-3f8f-5b4c-bafb-0ede94f2e718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e72fa8bd-f806-5765-82dd-f3f23558cfdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:65f1e45a-e9ec-5f88-a553-9908a9937493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8c5f796f-b4b1-5cba-afeb-9147a75d79b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1c50c083-3764-59dc-8349-eca3db607b79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2ce02909-3c14-5a32-be29-fd45c2eb5973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c91a1bea-4bf5-56dd-b55a-fff395ae5ebc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:48da49d5-e075-5884-bd54-374c70158143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@6.1.15-tuxcare.6" } ] }