{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7fc6d21d-21af-52a8-8a69-0539a8bc1361", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a30e0fc5-f9d9-59c9-8eaf-0926e5c6f5e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5a6f6705-b702-5e2c-a440-ec9f813876a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:98f986d2-218c-5aa6-baaf-729e72761f29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:846a6644-5820-5307-beff-fca4d821c90c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4f3563bf-9331-5ec0-aeea-e458723b0034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0ec8fb7a-4315-5abd-b71f-4b96cd3b1157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4e94f136-41aa-52c3-9b77-ec226048f742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9d2bff31-c040-5b79-879e-20e973082d70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:057beace-1065-5df3-bf3e-9997e3e59955", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2be9f5dc-09e7-5a48-ad5b-6067b1f90e32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6ba092ec-aece-5d07-a081-dde8b334edd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1dba124a-b8a0-5970-b344-3cec6ed3d03e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4d816050-a561-5b21-8170-ec5301f35cb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dee1005b-009b-5891-980d-8be718efefe1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e4ad776a-27d7-5301-96be-a3f34cc0ebb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a9e360b5-a706-5e82-9ee4-b36593274e1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:afb28e8b-7875-503a-8369-2d17710472fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6a3853e2-d361-5186-bc93-e18b303c8390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9fb8157a-e661-51bc-9bda-999ed25604bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:63746347-e0b5-588a-93a8-2533bba4b1d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2a3e6774-d763-581d-afee-2956ea75a88c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:99dffade-fcb8-5d1b-bcf4-5431aafeb6f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0e995811-2cf5-5374-b4d1-1de98edee123", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9cdcfe93-b398-5e9f-ba64-d1fb79dd49db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3dbbb214-db7c-5da3-9897-5bf2fe633bff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5f181591-7ae8-58b5-aeb7-52de5c676f10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2cb9c89b-850c-5870-8feb-2974d4230f57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e263e27c-d5fd-5863-a465-d78be9d118b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c498f3fc-b520-5cf8-a2de-8033b66921d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2bd02a45-7169-5948-a867-76a3f3b4901f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:961e44bf-430d-58d0-ae77-724f30060847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5fb8dc5d-7709-51c5-ace4-59ea1305077a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6cc97fb7-bb4e-5415-bb02-525727585789", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a6e40b62-0dae-586b-9ab7-1860cce41739", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:20e125ef-c717-5333-acad-fbfcfc9d3887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0e550c65-1545-5a42-9058-7975f51b76dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d79ad9ba-6d4c-5891-8c6f-493733d74744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a871dfbf-1da7-519c-bfa1-b458640191f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-oxm. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3cd06c2e-d7b6-5ab9-b48f-d16761b50691", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f1044107-4ce5-54b5-8a7f-7867b131b8c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6b31d278-19cf-5abc-9256-c7b1a1a4e93e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d67b55cc-3eeb-5733-8672-fbedf1b4bb7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:45768838-c717-5563-b5c3-29e3727f4a71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3b1ecb18-425b-5380-943a-037abd8ba402", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8c8aa494-0137-5037-9b5b-b33d7ec1328e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:66c10a42-6daa-549f-bba7-954f6280ffd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:42a02bdc-4c1d-50a0-baaa-2f0df67b4fe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.16-tuxcare.10" } ] }