{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:48a0f1fa-63ba-5be2-93e1-c3d4afd40f4e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:17a57b85-fcfa-51fc-93dd-ba032f874d8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1d351b59-9789-5ef3-af68-32766f1ac682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:096169a8-2ed2-591d-8f51-75fe1db4da01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ae542cd6-5d34-5118-af19-2ddb5310dd83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:64775132-5378-5567-855f-450778fb7669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3701cb3f-1520-5ce0-ada9-226b516fb83a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:09c9a9a8-b613-5185-814b-9ca4a4c89725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ddca9938-1a46-5be4-8266-0dd4492fb57a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2d6ab05b-95e9-5091-919a-003a9d52825e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b1fbbc3e-1374-576c-b8aa-85d94207ca90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3c7f2c79-4ba1-500e-ad4b-3f89db4a7836", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:4425c403-2d9a-56c3-8722-ff1973cec042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d9c15816-e502-5a18-9993-35f0138e4e8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a0256abf-9c9c-52d4-acd8-bdd0d1218d41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d921cbfb-0a4f-5475-9321-2f6294a3f042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:33d1f24e-fd44-5753-887c-f1839bc71878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8e386697-834f-543c-8a61-76513a9ce912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:049cc7e6-2dcd-5600-be45-8c544874d71d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:aba6447d-31d9-5b4c-81e7-8849583a6aa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7dca6b3a-6676-514b-b122-a804f82f93c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:227980e9-1b8f-5fdc-85eb-dd5371fc158b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b1113fd9-e63d-5651-a008-8ef786bbe4f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:81f66913-8923-58d8-b8ba-27cee3719cb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6f5dfd37-c78f-51bb-b0ae-17b5097fc500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:81843d0d-fe7e-5843-9bb7-85dce413952d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1132d3c2-9fc9-59fb-b5e0-38a599fd913b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:497a0b34-728e-580b-9518-0da71217faf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:58755056-e89a-5e54-b4a1-8b6761f2999b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9ff66a4e-f2e4-58e1-b1fb-4f2a64b6d282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8ed943d9-aaad-5ce4-bca1-1de6d8588d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0e9263d8-7967-5ba3-b4ff-2d0449f87eda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:537ef3af-2995-5f99-ae36-86ea2622b2b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-orm. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:104b5486-fe29-5e14-abb2-fb5804c705dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:345d9e4c-e084-5b8c-ac30-3f203b26bdd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:88eb546b-c0e0-5ec3-a4e3-d2e7d7e55637", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cc9cecab-bb8f-5d80-8987-3a7722cd6f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d613b0bd-6271-59ed-83c2-4ca8ba5a6605", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:41c2f732-839e-5d95-99e7-b00a59fd5d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1e3b89e2-eb5b-5f2e-b83e-2520d65684a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2ee219be-277a-5fd4-a3e0-64e9a9e77514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:13b4211f-aff3-5e30-8368-3caa204a226a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.15-tuxcare.6" } ] }