{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:47af5b22-8dfc-5c64-8254-d1113a6006c2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1f343853-cd81-5e14-9758-4dfcb99abed7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cd56650e-c47a-5ae7-8908-cf46f8ebfe94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:791070a2-0a73-5d79-931d-d3c3c273ccaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2d4f19b5-abe0-567c-a7a9-b1fdf69be665", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fe12ab65-94f6-5170-a164-efabc46d9cd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:72952fa9-5e92-588b-a8db-1daac516e327", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fbb5bb53-86e3-5a49-a849-e04ff38eb4d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2ca0d86d-172b-5876-857f-d4589c7b05ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:57361861-c67e-5ae0-9e8b-bf8fbaa6ae91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2da7e82b-2421-556b-8647-764942cec94d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6f89fc4d-9a25-5167-886d-b57291819196", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3a326379-1afd-5aee-af8b-f03e6b1b9e61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:da2afb28-4ffe-5984-a089-b35c553f5c1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:80b583c7-4227-5eac-985e-ed6e82bf3fdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:057b071a-b480-5755-9aea-626ef287fac9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e4b3418b-cb80-5e0d-89c6-00c3980f6c9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b3f5aaf8-b0d0-5672-8ac7-34e580dd543d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4fa523cf-2206-50bb-978a-626710b9a9f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5910b6f8-222f-5124-8047-844faae35c5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dcc212cb-a4f7-59c2-b273-beb9aabb900b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bdba8a14-8ef6-5659-a687-a43571d59790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:87ab0612-dc6d-5398-925b-4fa7fc6e7c25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3c09e07a-8478-5d5b-abab-b91f8e43b7df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7ff36a00-860e-5c2d-8845-7820dcec638c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6c4de42e-2359-5b2b-a702-b6227bb1cbef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:88117bfc-c6ee-5185-89cd-362bd3af305a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e32a83c9-280c-5653-91e9-510d5d875472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:25a8a194-19bf-5a9c-89d5-445b53fe14d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cad3d6be-ea54-5a78-89e4-031f69e5cfc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:794b5507-a42f-5b76-a5fb-09b41bf6d108", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:955168d2-9539-57d8-b1da-d9242e86353c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cb0e7729-6a68-5943-bdb8-a6ed0b38f4e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:88e23e45-7acf-53b0-93a9-14b07d890b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2853d0a7-9de1-5a35-9353-a240d3f6ce50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e53cc00b-16f2-5726-ae73-373e3b019b33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:26900614-510c-5f80-8c8f-ec3199a6b565", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6aeddc90-ae2d-5882-870c-8859c123e41f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dd04d3ea-fe53-5c21-a1c3-7be970d92249", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-orm. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:02e86cfe-3213-57e0-835c-b5a22b6f2029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:feec9aad-da4d-5cdf-9f96-469fb3f38a76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4afbd55a-f2f7-5438-87e9-cc6ab0c0c9f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ae6cea74-1b65-5897-bb4b-a6511b55474a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:97332930-2b19-5171-903f-bcffb7481374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:54a4d4fe-f7a9-5cc6-a708-8c8962f9727e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2a7596eb-5d67-5bd2-8926-33a499232cbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cbc74749-4adc-515d-9db1-f4d78a04d619", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:01d96fbe-9190-57ba-8090-797ac557a851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.16-tuxcare.10" } ] }