{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eafeb530-485e-50df-9d9d-b8325baef82a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6378bae9-7eab-506f-9b56-1130b13fb732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7c96b520-0fd3-52b1-91f8-f19fc0592082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:75f9a731-cd94-5fce-8b89-a904aaa4189e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5e0a8f38-87e4-5ca0-9137-439004e13ba6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:38aa0910-a2b4-57f2-8b62-0b575abf9741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:713964b2-9ac6-5d8f-b641-5620673bb24f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8493adb2-caad-5ccc-818f-6aff5481efd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1f9b092d-3e3a-5b74-b801-fef7ee225fdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3bb292f1-a8e1-5a31-80e0-d7b83f5801aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:31ed8c91-662f-5079-aa87-5b90ea8fbebb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:497ec0d5-ebcb-5836-9f76-583f1066a405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d4867261-c056-5843-ba9e-d769d04db2a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:034cab43-6252-5f2c-b6e7-85d0457a1aab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c52e7aee-0904-5c05-a531-50fc518d61b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1c9d790f-39e1-51c3-bae6-3506acd5be82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f52301d3-5e0f-51db-b732-090ab1679174", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:850bf4c5-5405-5cfd-af60-a8a3f3df2ab4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:25004b2b-21fe-53d6-8cc7-d681ec4d6bf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ac8976b1-d99e-520e-a630-cfe4ff58d45a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3920c3b6-2159-525e-829b-4e5075fb7b55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6a9860c6-9fd9-56d4-92e9-02df2397abaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5e348bb8-ac50-5984-bcf1-5a07a31ac091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4a76c6bc-64b2-52ea-824f-92c2e53a34a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:092c7983-c095-579b-a268-37b6f7771e80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:62d347ee-462b-5f5b-a72d-4d8a20c1b01e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:00a8eef0-b71f-5a73-987d-e4083bb269d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:90ebcf48-96c4-5bc4-9cad-5fd6581dacad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:681112b6-1bb1-5211-8ddc-46dfb874a3ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:291cf3d7-d76b-5390-a6d8-469c6f1ee3b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:eee172b5-6653-55aa-91dd-bd8570bfab13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fb08ee37-600a-5861-b68c-121a7e80c576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3fb5eabd-1088-5a73-a986-180c6d17a0ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:30ec1ccd-840f-5b55-9722-b7af55697eef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e3bc4f7f-b9be-5f03-a557-56d163e93ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c3b28c27-33fb-5dc3-8bfe-09d315f02d1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:dcf3b739-f5cf-5a88-8036-5a5ef57eb2c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:335f5c6a-fd6e-53c3-93b8-e2107449e674", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:51a3b089-a026-5249-8f03-797508515384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8f033746-2fdb-5ad8-a2bf-cb3a69910eac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:919f6917-9ec4-56f8-9d57-05abeffe2920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7ad1b75f-277d-56f5-91e9-f94802a46f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.19-tuxcare.6" } ] }