{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e2b1e340-edd0-51eb-a9b1-ae069aed5beb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:760a4348-2041-5fca-9751-f584a91948f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e8dcea93-0d1b-5dcb-b2f6-a421396c4203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6131dcd4-bc91-5eff-8849-60898575bfd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:95d84e8d-aafe-5635-a025-2638fc6ea5ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cdf1bbb0-7c3c-504a-a4af-90715b403aaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d9210f8d-7e5b-5a63-b347-b864edf7812e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7f4052d6-8887-59db-bcb1-d3fe010e2510", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7b145318-ad67-5faa-89b5-0f55a9928c90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cb87effe-6883-5e05-b876-4a706407cb10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:40e61199-7418-5eab-9a96-6a9557c2da28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f2bc742c-71f0-5c32-9bcd-f7d32a207ac6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9d5f7714-5afd-571b-aa8d-0cf12d67c344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:39710b33-9f10-5cd2-9bca-b92b5507ae90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e86fd636-c4cd-5218-af4f-c7819a6773e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6d745824-253d-51df-8dfa-77c6e3492dcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4ff9ab66-c177-5c3a-b462-50a00f248001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:72819bed-028f-5982-9d40-edb0a2b7a406", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:74c20e48-2993-5f76-a286-2997695264a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8fb0e430-6081-5f56-9201-e028b0cfa3e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2557dc6a-194e-5f75-aa5d-2146423b3ade", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b3cadda3-5154-53f2-a550-0258e82a6d79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:209bce61-9e14-5fd5-9a4f-6176f102a773", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8915d709-4d3e-5187-9f59-06f960be9722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8e9fd897-3486-5e1e-96a0-a955e8b5f031", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:199604dd-eb6b-5b97-b024-01690d349ad6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:326687b9-be97-5c7e-86af-e16782fd6699", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dc333f9d-a79e-5f89-a05f-884368101731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7aecdaac-95a0-5480-89fc-3d31f02e5c96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:1520469d-c227-5e80-9edb-8d2aa4beb271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a64ae9c5-2ae8-54b1-8194-a5521bc2e963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f4c2d7fe-2fb4-5a6b-bee0-bff4ac65eb08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3550610f-29dc-5f63-b6af-892345b4bdb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f49d800b-c580-5e93-ae10-541382980dc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:57d21f63-7057-5d8b-ae9a-e201491b0aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:146ac8ff-4983-5ad2-9d48-cac549c34fa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f699cdd5-df49-55d9-914c-61ae9758a759", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7087fedf-366f-5924-8db7-e11b6216b569", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:242b9fbb-1ddc-5aa3-9ba8-eb1da7de395d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e609d8bb-9dc1-52cd-82d7-4fc9e5821ca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9e5563d1-a311-5adb-a3b9-4b44266a83e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9f84ce00-0df7-5e07-9152-ed5972f55698", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d8e9aa16-192c-50b6-8fcf-f27e7edda41e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5f7343ce-070e-5b37-ad00-f9060dc5a586", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:076a3c51-0316-57a4-8122-74b5a546344a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d85b8c90-ec97-5993-8bcd-99e8bb81238c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d7ed8843-5905-57cd-b203-840b8576c429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:825fb5ed-4135-527b-9fa2-6a7b486c0976", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.16-tuxcare.11" } ] }