{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:308167ab-bb6a-5af1-b15e-0ff9084c75c7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3a8b5393-36d1-56a3-8701-3794ed609721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fb054d99-31d9-5871-adf5-c7c5c73e50d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9d3753e0-f2a9-53af-a334-7b6bf74f306b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0156f9a5-9cf2-5272-b7f0-8ee4fcbbc2d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:489cf6a0-fce7-5f05-b873-8343192a788a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ed870a49-d83d-5e4d-b9bb-80999fc5a3f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0898c5f5-724a-537e-acda-9a770f77a077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8a592abb-b40b-5a1f-9e5f-10fcaee35fae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:286c1a41-7c17-5140-90c8-7f9625befd73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:14e2c27a-3847-5ebd-aeca-29fbab105168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5399f621-3f6f-5d54-8149-fd56c1b572be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:625e55e3-f3da-58bd-96e3-5a8658111034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cf8942db-486a-53fc-a21f-1aba6a2ecb08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b8136722-f20d-59a6-89ae-71c1f1be0eca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c1e160d4-364b-56ab-92b6-10876dc8eb60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f1618c5a-8674-5331-958c-5a8f058bd195", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7cca4d6f-7969-543b-ac47-fc19597d8d71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:226a66b9-6b8f-5f3c-960c-1512538cf5c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e46d94cd-f757-52ac-82e6-758eb8b13d58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:087fa9d5-5b40-5b0d-88eb-245dd0f866fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:501f094c-19fd-530d-990c-8b9226ea44a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3a6df6e9-d954-5f05-92c6-4dd9e91c125e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4157d72e-f034-5250-b71a-fc9cea52d79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a1bc0d43-0f3a-5402-adc1-9191a3eae012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:45957eba-3088-57d2-b6af-0870a6485962", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fe814fbd-2b6b-5e56-8eb7-5b4fe2af3799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4cadb05a-b4b3-5a23-8092-63bf9e4cc612", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:137dfc72-6c4a-588c-88b3-e1dee085178a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5b61369a-5794-570e-bbb9-907b10bf6027", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:92d9b8aa-7d76-5fb3-8567-5693a1cb4370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:10dffb56-ce82-593f-8ef2-714d9c269290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:47713e8b-f463-5476-830a-8053bfe7a726", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-oxm. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:05f5c05d-516b-57e3-a895-6548f8d46289", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:05fe7961-0326-5510-8782-5b5b01b3ee83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:aa744a4a-14d5-5d42-b1cc-1af7add19ada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:dfc96f68-d1e9-5498-870b-722337ee078c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2c09371d-1f54-5be5-9916-db5da44a36e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:36052ca1-c91f-5b43-a3ff-900350458ee8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e9497f59-9aed-59a9-9d8b-8d0691275ca5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e505bad6-b0a6-5412-b86e-1fc6b120949a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:21b935d3-d735-5547-8df3-41bb7a322e03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.1.19-tuxcare.6" } ] }