{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:806ececd-ddbc-57c5-b770-b175a94564de", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3ea5693f-a615-5d98-a645-92666ff2eea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b6dff27d-b6c4-5981-bc60-11c657c723d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0e7a2a79-f356-5d7d-9902-b2586943bbb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:feefacb1-151f-5420-ae8f-b018d34465ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0ff44364-f9e9-5fbc-9a42-eebc79075015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d1f0389b-644a-51a4-8fd1-11550d1b6172", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1213c9bf-bea9-57f3-bfd4-762415ce89be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:df7a18af-79fc-5ecb-8758-8543d84b50db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e91d31c1-f4e1-5d91-af00-42cea41f6662", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0c457dc5-4b06-5ad9-ad8b-8c75a3f5d68e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ff9a0222-0701-55ca-bc44-a5c29520bece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b5a08e2e-b84c-596c-b4ec-1433e6535e0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8f6f0f99-0857-5292-ba41-1ab3668c67f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9f3456b3-5373-5397-95be-d1f100b11e03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6d4c83ef-5b1f-5707-84e2-7f587378b44c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ba110a89-457c-54ae-97f7-bedd592accbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:dff93887-1101-5727-b062-89bef8f91a5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1eeebf0c-562f-5719-8601-92ecea76a6b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2b16cfb7-d940-5517-a439-09392cc17df7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fc80a0ec-4f82-58e8-825c-e965bdbe2e52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-tx. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:254ed55c-694a-544a-b889-040f8e2e6806", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d531071b-c9c8-5a8c-8a5f-231f10a5b11f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:25e0ade0-d359-546d-bbf4-64af743247ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:31097f25-71f3-54ed-b6fb-77ceb4692f31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8ddb7140-3992-5a5f-a02a-ace97701ca37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:52185dcf-7af5-5242-92a7-a0689531f89e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e6ab9ad9-1333-5cd8-b0d0-e441d1d11663", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fac4b99f-1cf8-583e-a80b-741dc472cda0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:84fc1c03-9446-5ebf-a318-05e33f87a44e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ee5c7080-e67a-5be1-86c1-e90d936d90cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:38c1b716-0048-5200-b5fe-f2630cf22504", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4ec4bce5-1042-5e8a-9fa7-3415b8488dfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:07a909fd-f030-5858-b1bf-70a130f7d69e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2688cd3a-88d6-53ac-9169-e2caf4e00529", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f48918ac-4d9a-5359-82db-fe39caf4eab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b193cb96-3b3d-5294-aa52-ce62259caef7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:96879fa9-38be-5623-a7f8-f151b5895732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e8bb83a1-4581-5f53-a619-f4176707b43c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fbbeed77-b5fa-5560-806e-000030566e66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-tx. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2d2c8109-032f-5013-9f69-a09b0137d63b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cc746859-d1d0-53da-8d81-713b8fd5cee3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:11f8dbf0-c9b4-5037-9e80-7bdc2b258dc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3caad187-21a5-5b82-ac8f-2fe8139ca149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b48c231a-f77c-5626-b6b9-ebd6cce97871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:49c60f51-ff7d-5e5b-bf4a-03ebd1f6d594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8fbd8797-abb5-50bd-8b45-d2bb1f8f3ca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5e3429b5-e308-5393-9a2b-c3c02fdaa345", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:015d225f-dff9-5fb7-a4a1-82d3f968264b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.12-tuxcare.6" } ] }