{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72dae612-6b72-5d86-9918-457a0f1b6dc8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:55eef204-3c0f-51e9-a438-d33425bec136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d02a98d2-f570-5f9b-800b-186e3e79edc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e821bd3b-693c-576f-8a79-c6cfc732a528", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6b2ff814-4aec-569e-a54a-61a8393ca963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:53594697-e32d-59ee-a78b-d81e34be8fed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3e01c56d-83fb-5ac9-858c-c165bfb3a2c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0a84a516-3496-5985-ae31-3c7b31928713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:06eae38d-4ce7-5e2e-8b70-1757bb6d6160", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3ec66c3f-a59a-598e-affc-54cd38b0337a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ec8b2cae-a6e6-51c5-9d5f-5a6d3e60bf30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a460755a-f52c-5527-8ffc-263ca321fb57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:56cf937b-fe73-55d8-9935-597a7864ea69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:80db06ac-b7e8-5378-9792-08fe92078de3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ee5cce6d-3f49-5ec7-8eb4-1f1a6c0a17d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e82a2b8a-e4c5-5853-9dc0-09b63c8658de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7e55306e-92a6-5ead-8632-4a2e75ddb62e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3dd7b18f-fc81-50cf-bf0c-b24e7b1d59e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3b6c9ef2-2208-5db6-abe3-789fd8a92da9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:be510dce-933e-53d0-951d-e5a9b1c648eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2f750265-31e3-5c77-8bba-2368019a74c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ee70103a-8913-5fca-87c3-72c3224efbbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:56205dba-b462-5e11-aaa1-520d93e6c6c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:925f382f-8bb1-5e98-aaa5-930d02a44763", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:77c5c0b7-9518-5669-a5c2-a3cc020e2644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:eb7cf497-0ef4-53d2-b21d-7c23a492a704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9dcca651-aecd-52cd-8544-a22574fed88d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:93c8e4a2-4f52-58ef-85b6-0de3e57725c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:85a65b5e-3b72-573e-b6c1-6ea8801ef7df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2de66202-6466-5618-9ac5-598935991998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5a424dce-db0e-53f5-b023-2fb08cf82364", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0d061569-33e9-56d9-bbfb-3bae514013b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d9230fcd-5300-5266-9a8e-5e2c9c75f49b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e71a550d-bfea-58f7-a3ac-7e6432b9d2b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f27409ea-f13b-52de-9de9-f4b91d9cc11e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-oxm. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2c2b4ca5-3516-5d49-9979-eda80eb8d852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:264df755-b72e-539e-90a9-326f3139361c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8d9880a2-d318-58d8-b4e5-75da9de4d53e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9edca4b2-6a72-510b-a895-eb2ef36a876a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:252e5270-bf68-5610-9680-8391a57bf0fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1f3f2d14-837b-5f05-8192-91762eb5e421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:799aa0c0-d45e-542b-9f18-03ee5fa4dda4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2ea0a116-f2fe-5f98-bdf4-17a959a91067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d4ff4e12-863c-5b56-8737-22cbe15211d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.12" } ] }