{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8f76104a-baad-5f21-9182-24ac3eb5b1f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f8357f6b-6d66-5606-a419-c7319afb1176", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8a90df44-ad40-5ae3-ba84-d100e18fa12b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d01860dd-0a4d-50f6-9b9d-dd2760e4d60d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d183ce8b-04a3-5397-8d39-bb102b51b04d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fe46703b-9525-5fed-9326-3a436bfb126b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fda2ec5a-d149-53fa-848a-b94dfebfc7a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a0c4d2f0-ca23-5ed8-9336-748c7a7aea0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:eb87eb9c-7471-53d8-bf30-d1e61d989c67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b7b9a31b-a288-551e-8c46-7d865063ce16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:53db0feb-873f-5750-bf0f-36ee2b20784a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f8c0d81a-6ae2-5775-b3ac-6233efd289c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:07ed7203-dbfc-55dd-8bb8-483a1aee7e82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b3d8d237-7f8e-5c39-b099-6246f791402e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:bf1fa7c7-5dea-5306-9ce3-66e181eb82cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:750f5504-bb3b-5fb8-bf29-39bb5aaaff79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2bfaa912-83e6-5e33-a816-fde55b20894d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4a5e772c-e087-570d-ae75-64a95ad2f2b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ec7938c7-a084-52d1-9b9e-189f76391446", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:78c51dc2-989c-5aad-8469-c0a4ed871eb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:48ab5066-7804-539b-b058-4317814c815b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6c8969d3-2c9c-5950-9c10-a4e005aeb703", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a0c69463-5016-56bf-a027-f52c4e99a00e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0be58859-d69d-5391-945f-a8db294ab42d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d44f0c92-c578-5759-b815-749b470f5c67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:194789b1-054d-5698-afcd-d77538034f15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b3adf3dc-53df-5d70-993d-fe22f1326909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7001ae46-7496-576b-84be-528420d1d289", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:81ac84dc-8958-59bb-8b8c-98321b4bc186", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f241f2bb-a89d-5610-84cc-16f056897249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:238c6a20-fc14-55f7-9ff6-987530e935ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ff663b20-8c88-5688-941c-a7689909d52b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:345b008c-9c32-55e6-af0c-f3039c9026ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b4db5631-cefd-5c01-90e4-7fecd4f15c84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d39519e2-681b-55b2-9f97-e96f16a7ea79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-orm. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:922ce63c-fd56-5914-97a8-46a8e01fb4f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:11c5efcb-40cb-587a-86df-df9e1caae6e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7b9902ee-e9fc-58a6-a51e-d04e537310d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:561d26ec-c974-5c9a-96e8-b135cd866afd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8a9f5f86-4a3b-5be0-8ce4-0ffc933bc189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d19d3cfc-8674-5f96-a91c-19717d8ae966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ebd69fdb-2a28-5f38-a6cc-ef5c875fcac9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dcdd5e25-95da-5ce2-a8b9-606469064c6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d06c95a1-42cd-5382-9a26-c44cfb35817f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.12" } ] }