{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b98f2dd-0d97-546c-a9d0-16c7dbc1e723", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b1ee8d09-b421-559f-9679-1aca669f2a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d2593438-eae1-5d60-a9ca-3f309cb47825", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2f35e314-7615-5905-bd28-aaaff552783a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:339e8bbe-b033-5501-b9a1-34fff2f71a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0398c96b-5fc0-54e7-b8fd-0baf2f61d122", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8498912e-a98c-5090-b1d0-18277a610593", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d7d261eb-0afe-58b1-928e-af9ff46f1d8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b70a34f3-d978-5a7f-8c8e-ea0da97a813d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f8c50942-2fd0-590e-8100-cdbd99ae6371", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b3a62c86-02b1-5788-9d5c-ffcd06ba80f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5d797c7b-e900-5423-99c9-1487ea2ab3fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d0188294-ebd5-5d2f-ae7f-5a928a960086", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:be57971a-5584-50b5-8498-3351cc7ec209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:98c4f0c9-bd44-57e9-bb56-47d6357d14c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:308530ab-b29b-5bbc-bda9-bb979f955229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c536dfe7-b56a-5573-b4ae-1a52941777cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:551c97d9-19f6-5fae-99f8-3101ce749ac5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9b9b4a71-5db8-5f6d-b2e4-de075f448a6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:39b8d295-bd79-5d06-a724-fdf97a63deec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:705fe9e8-4b74-5694-bbb6-4512a198c2e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:72ab52ae-7e0d-58d3-ac5b-1536fd70bbb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3460a0fa-ce73-52af-a6d4-92180affc1e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:bdc85d92-56cd-5765-8f92-5db0bbf722c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:87295f3a-6097-50a8-951c-aac6597b5569", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b1f68d59-74dd-51ad-be3d-db783c8a0297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cd053f68-8c93-58cf-a538-87ce4d8d5141", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b33d9274-6e02-585e-8bad-340c47ed64e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e1114b9e-54c8-5168-91e2-fac7da7ccc83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6c739081-5009-5bd4-a5b0-39bda544e074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c24383a1-6fab-5f14-8c80-a7f299838535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f4088aec-c732-52fc-858b-bd79eae98c39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cf13f00a-ac9f-5b62-9a4f-6d7421b2c0e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-oxm. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:fed83af2-8339-5a0d-b580-8eb56c4de45b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7281f371-507b-5245-b5c4-50910225da0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:591fb3c0-40bc-525f-a55d-045423c6fb6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:51e84201-a707-5e85-99c5-07a54d5d0683", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e4198a5b-9f94-512b-ba7d-ab425118a4f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:694072b1-f123-53dc-9e76-5d776d603795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5b412951-7c16-54af-907f-720ff9d92aeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f23bc829-866f-566e-b4b9-769787aa321e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3ea929eb-8924-5c6f-afd7-822fceba50e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.15-tuxcare.6" } ] }