{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a78ac35e-e25c-54f7-abad-4847ba1c85f9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e2b556fa-d291-5159-8296-e60caf94ced2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a3b95437-45a3-5750-aa67-9f6a937a3476", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e5e8d26a-26d3-5860-9f2e-a1e4dd10bdb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a540840b-cbbf-5fc5-9d38-c865f9caea26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:83afe514-bd41-50d4-b51e-fc6f4162aa22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0a948962-eaf6-5295-9995-f1e554a1960a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6e484e56-71c7-5d15-9403-64e21a78f191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1dff75b2-8629-5ec4-96ce-770abe9b07e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:acbd45ca-a825-5dee-9958-d7d18e7e4d8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:06199c1d-e702-5756-9b44-c661ad374c1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c0fd7f10-0c95-5b18-95e1-5ee7e9ccec4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:77f0adb1-6bd0-52e5-8631-6a4712c6bc3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f4c1650b-d4de-5b4b-83b6-e5a542be6455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:14ed490f-bd7a-58da-9f42-84fd00a5b45d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:32a78eba-d1c5-576f-852a-1b72ca1966ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c54ff91c-b61e-5797-8dc7-05d42ad1b2cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7c36bfe4-57ce-53ca-be60-9290d68cb40b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:829ab357-860f-5ea8-a0ef-985cf49b0521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:89630f22-bf6d-5157-a8c3-c8cb739e7fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fa8e5aa3-531a-5d66-9579-546cee6806d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a8f00f28-c223-5cb2-87cd-c9365b91cfe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b112d0f5-d7f2-5a26-aab6-76245e829b34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6350e84f-3f9e-59d2-b686-ca697fb66700", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a72eceb5-44c7-5775-98fa-dcba1bb1e219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0f46a0c7-0c6b-5be9-b62b-9b321b214b99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d49f0d30-2877-54ae-9cee-30b7d7a951e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4cdb6e43-036f-5765-8c10-7ad5fe91a70a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9324a884-5735-5721-ac4f-c3a21c08556e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:03c9e31b-5221-5b68-82b5-744a9c69dfaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a98d3b21-9a07-513a-95d9-f410c9dbb93f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:00834700-c294-5d5d-978f-04e9acc891da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3e424fee-19e6-5d89-ae9d-6ee4aa35c98d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-orm. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cdb2dec3-284e-5cf3-8729-ba66bc9d1a16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f28ff947-fb47-5390-8321-cc81c8dc0ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c2e8292f-e967-5a22-9c92-4471eb2dc0b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a643dca1-727b-5595-be60-df4cfb0a918a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:133f6153-6f8d-57f2-bf7b-5ad01043a4cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b25f4c18-3fb4-5c48-bb9a-3c53f8cbf82c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ec9c27ac-22a3-55cb-83e4-24bddd7c3a90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:548fd4a3-cfa1-59ea-80e8-5b2516003801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a0066ff9-be04-543a-becc-a31fe39755f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.19-tuxcare.6" } ] }