{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:473c91c6-19c3-5fe9-807a-867c6edaa01c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2bdfa902-491c-5d08-8f16-bb2377a949d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:89bc796c-c374-5241-a13f-6a62aaa287c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cbcc8ff3-56bb-51f0-906a-761fe978ba71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:04ac500e-b177-53bc-923c-61edf08d0ef3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2f5c83ca-2244-5829-a22d-06b6320b9502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e02e5d44-976b-55e3-a75b-a62ffa22ee88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f836e9ea-ca75-592b-93ab-5e3cd2880785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b4c23c78-03d3-5c8a-90e7-0ae00e772c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:12a0fc20-3234-5e19-94af-298ed7dc2460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e08ee62a-ac1d-5892-997c-60fb6d11ade1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c3fba7c5-b1eb-5d9e-914a-b893e56f0a5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d3295e02-2e72-5ccb-ba74-bf0f3aaa7f76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fb3df903-da00-5429-b06c-508c89302355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:33a98bf5-fc3c-5115-990b-ebf94272d256", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:461e74ba-5ce6-5ae6-83be-9b427c6a70db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:466068e2-c65a-58ab-b054-87fa4fa4a2c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8c7d60ca-87b8-5ad1-ad81-48da7b246bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7798d7fc-46b0-5385-84a6-0fb8083fa841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d92ac680-ace2-5e1d-a474-9a26deea8241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6e45caef-026a-529c-9dac-c30c5dbb62ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1f32dd9c-9205-5c24-acd2-9187a0a2e890", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:aa66d7d2-d9ad-5b85-b3ae-3e74c42beb10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ce91fcc9-fbe9-56e6-ad53-73ef6c61f0b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b059b6b0-b2e9-5324-af63-ab671360e433", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ce1163fb-6da1-5180-815e-48e69a3e95fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:868c55c3-1199-5937-a50d-2db115d0f42a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a80093b9-d14a-5288-a8f0-0cf2153a1364", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0bbc66d7-d63b-5a17-8b81-73f190452adb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4780d391-ecd7-51c3-9b72-51793809c0fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6d81064b-662d-5a8e-b108-75d9b7bed890", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9a4dfee5-0c46-5f6e-be3a-b77759bb7b89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:440162dd-2107-5339-b966-d1a70892b301", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4b9c0937-b274-515e-b8f8-ab03db87081f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5beb8be4-31dd-57ee-9780-973d15ad7228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4a7c53dd-e9eb-52df-8bd6-b669bd5e11db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:05ad5955-4892-5dea-b979-a9fd23347601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7288ba2e-d487-5496-b2a1-f612cca496d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:313290d1-6256-5827-b44b-77b168d4b6fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:62647071-6477-5cfa-8df8-65d03f11fca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:87f62504-cf98-5db4-b85a-ea0945eda54c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d4fdcd41-3197-594e-927c-f94bad3607ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f67c8737-2348-5962-9275-01db6c2b901c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fd35c719-7199-5fec-8db0-319810c09a47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ca9e6132-c1b3-51cd-994a-3ae331ea2c72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4c40ac25-f070-5db7-b675-2e9b007e1ba0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2f234473-5d80-5b72-8134-f99988dc4e65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2e191afd-06e6-5719-ae45-1d2b9bc58af5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ] }