{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a02574e-3b1f-5a11-ba61-acba3b6e9078", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2aa1b692-96ce-5c08-8694-366ef750da91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5590992e-c391-5914-840a-31ac4835343c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a0b36787-a47e-5edb-8f5a-e81acfbe9c60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b91a8282-9473-5c6f-bb7d-aa43b6456782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:93e2ce2f-498f-51c5-835c-86af0cf705a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f5c27bb2-7249-510d-a0e3-a56379720f4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8efc9ba9-65c8-5f0e-b71d-61467170e294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8e5f6cec-4251-5617-84d2-bd3cc08cbd15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7d68383a-b190-52cf-91e3-14ac6d1a04ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a16d8491-c166-5365-b0ae-bfa5e8a3bafd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c9327ddf-4d98-502e-af19-0ce5fba9835e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:82d1032a-61ca-5e10-abea-e99c010f859f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7d483653-ad55-5321-afcc-bdfac50f31e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e85662e4-b2af-5140-ab5d-e3bd47085f4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d2dffd52-c6e2-5c88-8e16-710fc68ce5b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9c488e5e-7636-5142-a385-583f144f1b7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4a09a348-d07d-595a-9c8f-67dc2614ceab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d8f1c70e-19d7-5d0c-9937-e4555d4be81b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4b6aa16b-8ee6-5896-8c76-f2df5de06b54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4686c3ff-c2d3-5cdd-bb13-72e88ce4f909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:406c247d-1670-5587-97fd-fd9ae7c9c5fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d2c79484-ad4c-5bfa-b624-b95ef7c063e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a3308f07-82b9-5171-a790-c90778b5e944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5c9b5469-e432-5144-8c3d-1889a03423ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:816dde19-1fd1-54ca-96e0-f6adef5e2737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b92aea4b-23ba-5017-b272-f25b42d1fcbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:701167c5-6bf9-5d0b-b95a-a18a9c870cbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6fb8d85e-9eac-5139-b372-2d9ed203ac27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:763c47a1-f2ba-5f0b-8971-1f67fa9dda5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ea980262-52d6-5657-bc99-27fec3c8b31c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4d8a5676-6795-5b95-964e-6ca120069592", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:43c4ac1e-779d-56cc-aa71-2856144e9aba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:03c6aa5a-5801-5385-bcb4-d31c306d04dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fd45745f-0fc8-527d-becd-80be82356760", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:46b42c81-1d85-5f69-ad9a-d1205082c43e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f8b72652-1fb9-5fa1-a2fd-5f7c4cc5068d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c338a03c-5723-53ff-a65f-8922f10e367d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:24bf09da-82de-565b-8167-f873b9a9bbe6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-test. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f7388cd8-c916-575b-963b-9a2435ddd6c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e5366641-320d-51b7-a5f0-125bc5e0ca98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:32d9730c-ecd2-58a5-b963-f712eeb4704d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:df4cdb4f-bae1-51af-8641-b4444231bbba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3058d5f0-98d2-57f6-8cac-fabfb2b9a5dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:6c3244dd-57af-5ba7-aab6-af40e75f6ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cc63b23c-0541-5d6d-a3df-ebb0f7748a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8f01f30e-3b61-50ea-9697-1c09ad15b4d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:68da8f2e-b3c5-5040-b5a5-46369930cd3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-test." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@6.0.16-tuxcare.11" } ] }