{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f6123b9c-5b3f-56c9-b5aa-1b46cb507712", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:07d26449-cfe2-5bd6-a774-5dc18d4b1d37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a88ab74c-fda8-5c60-894a-ecc39c4e8bd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9f302219-2923-5c3a-acdf-9c28a81862ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:92f59952-6883-57ff-b325-f2a0df84ab83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:400493e8-1569-501f-aca4-62ec09545d0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ff73fab5-ff81-5b1e-a6c2-d3faf420ecde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ed3d23d0-d6bf-5ca4-91d4-149b46fdcc07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a74faa8f-93af-578d-af4c-4c788ec870f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cbb463e9-1eb9-5d0d-aa9c-eddab446d09f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a8ff9e09-59d8-544f-b67e-75779f1da1e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:048c3758-3b4e-5836-bff2-2e00dc6f7d10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:aa420df4-48af-578c-9862-c21c1495e26c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:836d9f38-fc3d-5397-8412-6db7b4c97acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1c3bed1b-abee-5393-bb69-ae1d4a7f901e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:88b4414c-9dfd-5cf7-867f-d8f22d02c780", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6bbc91e3-f269-5b3e-a2ba-93e073b2266f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e7de7eac-50a0-59d1-a7c6-76ae0efc04be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:397274de-cbed-5af9-af49-95e3c8c87144", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dd54df40-960b-5a4e-995a-5a2a9ecc607b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6c5c0ada-f2e1-5690-ab91-353be8b7afc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:657eb55b-725e-573c-bf93-73de7fff8e1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5eea2480-a29a-5da5-9511-31b30e5946ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d9e6b251-255c-57c4-a603-1b9f66269512", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d32b1477-41fb-5d94-8aa1-36cf7507da28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8f25a52a-af57-5ec7-95e2-7d6608f6c76a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:561e39c1-e3eb-5a4f-b130-ce24ae16ca67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9f4560b0-2430-5c8c-b3fd-f9257e7e219c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0f3ac8a5-1865-5724-9a61-fc2f66b9ed76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1ccaf27c-8bdc-5316-b3eb-82560c700037", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b36ea356-0131-5315-ae3b-cbe72f117ec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:196003eb-8138-59ad-9016-73884050d05b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4a23bf04-95f2-5731-b503-4ce99902cec4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ec09e50e-32c5-51e3-9678-33eb4f6a0c4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c5a011a1-28e6-56ff-946b-36774e56b37a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bb33426e-43d6-5023-b32b-6aac141bc02f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8444f969-f8b9-51d2-8410-d698b3001c47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a1898a0a-3652-5bb3-9c70-f8c0f79f29ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f8e7387b-4aad-5747-8090-3e04ed1cce7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:57a3025c-3f8c-5507-890e-cd86226b6f24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-orm. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:618de113-4be7-5534-a95e-3e310752b911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7334ad98-298c-5a7e-a0ad-802bdc9026bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:83ad72be-b195-5fe9-bc5b-2aa937209201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:55512399-7b1c-5d78-adfa-8166f2b12b65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0f6b78a8-71e7-5ab7-be6b-40b3ca70d02a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:76e18296-b8ea-5c22-91fb-b50c2019b2f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:231e71de-0f10-5422-bab8-9f88ce9bf096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0ea3cac7-075e-50a3-876e-a1624edb449a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:acbb1c2f-4449-5239-8eb3-447013081910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.11-tuxcare.6" } ] }