{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:984fa1be-2588-5d3e-9240-34ffac33676d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b9955fd7-e769-5b53-a1c6-358fccc83d0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:744212d1-dda3-569a-b38e-5a7b51a8bec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:91267c6a-1fbd-5d5a-b986-3ea995bb4a04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:16db9af8-6a2e-5001-854c-da25a02600b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8fbe1260-aba1-56b1-a04d-a50df060ac0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2e004b0e-923b-5a7a-9f8d-9f5a9f69b7a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d32b728f-88e7-5e40-a17f-b1282489d410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:95b35d54-1f0a-5291-aefb-ed1f369e7aa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:daeeb443-b34a-5229-9233-dc5e77b35d26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2af13513-63e3-5586-9a3a-a7866e450c05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:148bbc31-593b-5e12-8ff5-8a410fce80f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:db1acd57-3896-5f19-ad97-88d21f61c6e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b0e75b53-aa6a-5a4a-be27-93ef1c87d7d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b6037fc3-382c-5dd8-abaf-e16dfbedba3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:34a5a645-3f7a-5af6-8e61-e39529e68c0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9f1dd557-9cd0-592f-b3b7-3d785a4a2143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1fb908e0-33ac-5442-ac41-ca8d1b585980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:25210b1d-1158-5b18-8d67-66378e45d09f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5b3d90c1-97d2-5214-940c-334cc2a3a86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:59f227ec-63f3-503a-bbc9-be5af6fd1b87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:54259f8f-aa0a-5f98-8c5c-58900c4b8e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:271d6ea0-aeaa-5e67-b852-6edfc4150410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:749553bc-8627-555f-a4a7-376a92ba04f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3299be56-ca3a-5b4d-b92c-924714d7b6b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4e14e2dd-2fa6-5dfc-b81f-2b7276be6881", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5de9d7f8-e727-5e9a-bfee-8fa3ef09a55a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e8ba1fe9-7058-5728-a58b-52e6a35c4985", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:06f53877-eab4-5e10-99d4-842a86bf3aa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7a8e5e4b-6aad-534c-b6f4-a13445204478", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9d5c3b7e-ec67-5e9a-8b71-122fb2696a4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ae2847b5-29dd-51ef-b71b-a47ea63e0e1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6c4baac2-f416-537e-9335-cc8f6cb0118f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d0afa536-9e04-513a-96b1-7d1fe8cd58c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:df221a76-2d21-56a1-bc95-2b09aba72173", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a9b6d1bb-764c-5586-bbc4-79c428a286bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:88c62c5b-a0ea-5c62-8a3a-944723c3b502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2bb47a09-19f2-5775-b0bf-7215445e9711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4acc9eeb-896b-5bab-a20a-054c9843621a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6fd7f070-10cb-5451-9e7d-5ab0e8ebb3a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3870c000-848c-5e5d-88c7-4f993296abde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b89ad68c-cf2c-5c3b-aa5b-51fbc4cb1135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:700438be-d8c8-5b21-81cd-f13ef3162931", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b09506f8-19f5-5ab5-b3d3-50b0224d5209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2025d81c-c583-594a-b0cb-78b249ea5dea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4b430be9-38f7-5b84-9816-b3edaa423dbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bf5b2f46-6dd2-5a76-8695-130249ee4a35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d5c39612-2e68-53fb-aab3-bff9012fa756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bfe21109-21a1-58cc-9726-476a0a832b67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ] }