{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a32b2b0c-7409-5d25-bd28-b3f1bca9a4cd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:27fa76fd-7afe-5a16-a502-e0208e69ae8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6f31b7de-1968-57a8-b065-cdd4a1d57a49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1da73d7d-7cef-515d-b317-1c6ca7644f69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:75c0ef69-8ae7-5483-9347-ab08771b87cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0f7ddbe9-5f27-5848-8b5b-3549356fabad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d7d6e26a-4bf0-5e82-8146-b86f3a75e760", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:10b4e4d7-f146-595f-9eac-2ed0696863bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1faecf88-3496-5244-b7f6-f2fa65d064d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1cb514c2-f584-5146-ad7c-05781e338bd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:15dc3295-35f7-5180-b830-2f988e46b35c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:38f369b8-c814-5d29-98ab-be789efad86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ceef006b-2de1-5877-9a2a-2c3aa23bf013", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b99e7c98-1ff3-542d-9836-569c8e3dd181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d905aff2-903d-5f11-bb47-1b393d9d7f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f8a6e924-b87c-58b4-a130-9b1e99371d26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0d80b668-868b-5a8e-87f4-e144e66aa4cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ff4e143c-97c4-5ba2-8ec2-87d43d8fb851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d3dd88c7-a8ef-559c-bd9a-45dace45939d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:79764d38-5a81-5730-9d9e-715620e7f019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cfc0d14c-3a8f-5b48-b9ab-8d365abf7a43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:21c3dc55-47cb-537e-9e1c-da76754f9610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:38320a5f-ee34-5b40-a483-8e1aa4ffc64b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:67a6dc9f-e800-59fa-b9d4-181f2fdcd502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1b498ebe-4038-5491-9b66-ef74c76b25a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:831047a3-880c-50da-81b5-9524a55eaea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:795ad04d-0a0e-5c50-b53b-a6daa6b2eb8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:22e76e5b-23be-5230-8f62-b3af0b628469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1555cd15-bf26-5780-8b74-1570543b5661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3267e3f9-9fa6-5035-9af5-3529c93ec848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f443f67a-2c07-5556-b157-c8204e71df6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6351f036-7e1b-52d6-b819-3cd9f27de940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:07c60c35-f519-58da-b7b2-95d2c79a7530", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a4637321-f873-543a-8b98-298bceb65d2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:14d6d291-be69-5500-91a9-c86ca110836d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4a21e1e1-9354-50dd-95e4-c5037def6c89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:58ae3d23-1ac9-5bab-9f42-62eb30319b3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6f43134e-0d5d-5980-999c-fce4dc0bcafd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f9ed2995-bd52-5113-a4d5-0072dd6d13b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:11001aa8-762b-5c09-a345-32c54c839b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f9177499-518c-57dd-9f72-7569296c9986", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:912ce022-4050-54cf-98bd-6a1bfe7e47da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1bbd1799-6491-57ec-ae25-1f5616dc7b80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fe11c8a5-8744-514f-b79f-0b656dfc070a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ] }