{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca478f51-cca4-5e24-a5c9-707c74c65179", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c5701494-b1fb-518f-aaca-7d03cdf4c473", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3873d26d-2725-56d8-abd6-a5a9ee16b8bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2cba0928-1bb8-5be0-af2c-a16c4a8ece48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8916d9af-b06d-5cd7-bff1-7afb83d985f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3228241a-0435-564a-9045-8d57bbee1136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f69eb5f3-3660-5892-b801-8f114ecb2cc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ca8a2f51-99bd-5f2d-8c90-20e992a242ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cdfa3f7f-32b2-51fa-9b97-a0ae2f345342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1a010126-6c9a-5261-a7e9-573d4f4816a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8f092067-de9d-5efe-977d-1b6d30302a1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:901b0507-e326-559d-aea1-cc13f8535247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e2fe8798-828a-5c3b-bdf8-7139e4d234bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d1632384-6ea7-52d8-ab5b-1818ca7c993f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8ec730b1-ba37-50c0-950a-ef07dd17f881", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1987ac91-67e0-552c-b61b-ca58eb009321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fead0cf7-005a-571a-bdb4-76bf395146c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1acf2445-9f4f-5e39-9fe4-abeb057262e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0393c8b8-8650-54d1-b95b-708453b2117b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:66d74601-77d8-5634-a1ed-b8427e0d3c40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f69e50b8-f3e4-5ffa-b160-6f959c022062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8a2b4ce4-d522-5d36-8ff9-78a23151f7c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:02cb6cc5-149a-5fb5-8d6d-0935bfbaed6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:42302a28-d6ca-5d42-b3b8-e6e25344d556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b6498a9a-3319-5446-8815-8cff7b7dbcee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e46795fe-73ec-5b8e-be4f-31ed80ec08c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:787d6e1c-86b8-56ac-b90d-4d3275438436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1cde39e7-bf3b-598e-91bd-3b1b2827b18f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:042c66cc-fe77-5af2-baf9-9300a58d6e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:04c964ac-9af9-5e06-a7ac-5c3ca9d3577b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6db4772c-fb11-5e04-8bc6-8d4422d410f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:07f05876-7261-52d8-95b5-3ffa4afcca12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:631977d4-4f37-5262-bdb7-bebde97b030e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:eac316b7-0943-5337-942a-9c29facd7e4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f101c17f-c089-585d-9963-05187654264e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:15a34117-ff84-5b12-957d-f0e5da221b15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b807f0cc-a29a-5bcc-b141-f3ce7d87d079", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c9181639-ca16-56a6-be23-06476d5d9b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:659c7b10-3a82-5f40-9a61-795721e21d9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5df353fb-1970-5524-ba1c-2988f63c89f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d8adf785-d538-5bdc-be0e-82d2039632be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d6d8c0d4-3ab6-5e23-8c23-d4d88efb24ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4720a1a0-585e-526b-971f-3f1686801986", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d38969fb-0bfb-5fab-8e2f-6aaae5bcafe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ] }