{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1171fc79-e7cd-5fb6-a6ca-fb19f437991f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0b99216d-6617-538a-a39d-55d01153376e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c0a2c0fb-f022-588c-b8f6-04e257259fa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bca05d28-4fe0-56f4-9226-a4cb796e0c49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c323439a-2ffa-5d1e-92fc-46194b970ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:534f94da-cdd2-52ee-89ca-36d47d9e046b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7bd50a7b-1d4a-5a85-a8e5-457875752860", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b1feb175-d8a4-52bf-870e-03852ceaeb22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4fbfb36c-7f85-54ba-920c-ff6905c5803e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:06ba7e8d-1486-5d7f-b6f0-62c8ce43c244", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:671f6b44-b6d4-575e-8a7d-ad95ad4ea736", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0af9a36e-494f-5fce-8868-92888d2e449d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a81dbb63-ff4b-5736-a87f-0bb8192e267a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1e6909aa-eca2-5f07-94bd-92518a417e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f8833e70-b58a-5b80-90dc-066b4589769f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:eb09f8bc-b970-5ec1-8f36-dcebeb0233f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9f4c4340-bd05-58e5-a2c4-90f35fdc6513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:944cd559-bc63-536e-b016-28aa59ac911e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b434fd4f-1749-5849-8d69-3cd3b6249cfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6825b50d-62ce-5972-8fb0-a7b731f0f824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2fc3f4bb-c849-5ac6-8239-fa53c08bab40", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cd60af4f-b856-563c-923e-3e203caabc9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:76d89da4-dc08-52ea-8752-cee047254f05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7423fa5d-ca23-5c3a-a02a-000b5aca12b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:931dadc4-e178-5f12-b727-db00e3c94c41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7baf24f4-5041-5b32-a5b4-f8db4ee13cd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:615ef6ab-b0e0-5325-a9aa-045122f1be45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3ca9c265-4152-54b0-ad79-04fa4025da13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f49dd654-1377-5645-8361-a8befe8db864", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:85bb13e2-22fd-5cac-ae05-b8ca790bf5f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e7d1eb0d-10b5-527c-b1c6-63074be24585", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:46c987c8-1a59-516b-9760-c956e9639b4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7611ed26-d7c2-58d2-b111-32ed322f0c96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f5625504-f309-5110-a3e7-a672d8ba9bf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3355d4f7-fb7e-58f5-9037-42a01b9a7231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a316ee52-0d5f-5bba-836a-cc7f0d31b3e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:eba3cbf9-3a51-5dde-b59c-0f3543bea2e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4d033232-444e-5cd3-b681-0b780f475d68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4fce2f17-c4ed-5da6-bd7b-7186f5b67e20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6bfe4007-2d7d-5cee-8225-6d20b56fc839", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:acea8505-409b-5985-b3a8-42109ff482da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e32a75af-6f2d-59ac-a9f1-316ce0c97005", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:48b985bd-a953-51e9-8523-e1c8bfaf7496", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3ca88a27-a4ee-5539-bf62-5881e1b089c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:942e76ee-3793-5a7e-b512-ab4cd93fcbf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:302a1bb1-3b5b-51c6-a836-b944e733e200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e45c1bdd-18c1-5b66-87a6-3d40b9b14696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:de9d2e8e-0c61-5da2-bf23-3f0923a968a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d07b4e11-c094-524f-b9c9-a3d927abcceb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.6" } ] }