{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f132752c-6f76-5e42-9f1b-b06aed3ffdec", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c4d6958f-7f5d-5964-9a51-ccb23f6dfc99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e4bb97d1-c18c-504d-9f32-1d95d5823472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:647d293d-cc0b-5d32-86d9-100f0d0f46f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:616c027d-42ed-5ceb-9e18-43d5482d289f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3ab78be5-b15f-55bb-bd51-496821a1084f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5d1dd9a2-c012-547c-9663-828c3b0709b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:20849071-5862-5756-97c9-4b8c58dc00f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:200516aa-309c-55b4-838d-889a73ca5173", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7ac95d56-2a25-534f-915d-2e1f5b9135a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:81672071-89e5-56a0-bcc8-489ac992da8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:96a4d691-f7e0-52a9-9a23-8ff23bfc2c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2bf124ff-96ff-5daa-9008-3842a488067e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8d5407f8-706a-5859-a37a-74b10a0de5b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4d52d47a-fe15-52ea-a1ca-a80a54e4ce1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c2e6b736-bd0f-5c91-af83-cfadbbca4718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:08541478-7170-5726-8e64-bd8e2590cb13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:496f1b68-8d85-5485-9245-a455ebe1eabd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:53f8dbf8-7280-57e3-9d1e-752d1587e08a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3c2345a5-1e4b-5911-8063-61e4083f302d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:811c27b9-1062-5d2f-ac38-8e798ba43562", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2dbdae46-82c4-53c2-aa02-4eec0cd283f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:58c7e511-c4c7-5e7c-b3bf-6177bf8e8068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:27edec3a-1264-5780-a079-4bc60b5edac8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e5d5931c-a0eb-55e0-b58c-5a056ba92c05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d3142737-aacb-5677-9e68-f90c68f8a752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bf84aa45-3de7-564c-ba3e-d897dbd6ad28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4dd95c13-9fea-576f-816b-fb1def487247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3c583485-6db5-5e3d-a0e2-9eb98ee376ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c706157f-6f1a-51a7-8fd4-31634a0d30ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:abd501ee-7a7b-5c3d-b079-a5345ec44edd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3b57cc24-5756-53b0-9419-bea8ff3a440d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:32414c8a-84ef-5d5e-adce-9430c2449626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:098b19e7-3711-58a7-9da9-6e382486c310", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e2966ca8-c1e9-50eb-997e-5a6d08605cfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bfb20a8a-e97f-5aab-ba46-8e7bf67d378e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7feea672-e171-5d1d-9fa8-832f2cda8be2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d2a56855-9c6c-531e-a1f7-d9c74834848a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2bc7ed16-94da-5f5b-8a0d-1fb14e8f936b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-tx. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e5a287c5-4624-5555-b714-64f19b700531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:51bb7800-b7f9-5afc-a0c3-b353db53963b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:55ac2316-d075-5aff-9e35-e899957e4520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c7855c41-b881-51bb-ba42-ffd4250b6017", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4618a5e1-a24d-5b4a-bfab-48d41e78c064", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:47752c74-f1af-581a-86a3-1ea581e7f8ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c3cd8f98-dab6-5f31-a1d6-33ef4ae2dd51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:aaa26b86-d2c1-5e70-8d93-ec72fc6c792e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e67abecb-bfe2-5ce9-aa2b-f2497b2ec4b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.16-tuxcare.10" } ] }