{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f228e5f6-a8c2-50e2-a865-13758944bf38", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f4f6ef75-ff50-5df3-b49f-85985d1294f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a8c66da1-4aa8-565c-9650-caeb7806dcf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a7cbcf69-5ada-5639-b80f-d5b585c407b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:15ac68cd-d6db-56aa-a00e-5a32c1d577df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:10c7be2b-bdbf-5f04-99e0-28802d61b86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:31ce9eeb-13aa-5bbc-8ba6-af17dd9d46d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:dabac523-9946-5a6d-96af-1ffad567b8ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cf35ebb2-d50f-53d6-a570-06781963ef41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2115c2f4-6d97-58e9-a30f-e8f7e005adcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ce66fcf0-4eab-59f1-8f1b-c89c198ee1d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:438e8d35-6025-5660-b695-da8493a9b360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:857923ab-cc2a-529c-a973-2cd3e07ae4d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b1dfb7ff-ba27-5c5d-886d-b16f225f6c41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5ee397ef-0e06-51c8-adb3-a508ab6cac8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b30a46fd-9ff3-5aa8-94ed-9ec900100aa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2b0a1de5-b5e4-5fc9-8756-3fda4acf66df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b0ae3a0b-576c-5e3e-9622-7106bfc7eca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:929f93e1-4c7b-5c28-9117-a778c87a6fc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:72e6c0bd-2807-5d79-839b-6df3fefdd5e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:93f88d04-25ed-5562-9419-13deb6f47f90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f198a20b-f9af-56e7-a4d2-e0494b593dc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ec8bc5d3-53b5-5cda-b5bf-eb1fe568b214", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2b32d590-1412-5968-a49d-a4ba9983035c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d451e5a1-9117-5155-a84d-5c7ce2244cca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3f8e4f70-39e4-5a03-b6b8-6ba9ee5afa9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e7a2e228-e003-5ecc-8693-05526f301d0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:09d51bdb-22c7-5d23-8081-2091efdcc97e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2102f0cd-780d-56e7-bdfd-e0170e755153", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c0dac229-c92e-59ee-addc-feabef15318e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:89caf506-fac2-5077-a903-2862eafd0b16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ba052eee-5cd1-5423-8dda-718587ec7e68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5ba1e63d-3c3d-5ce1-993f-8db5c5be4199", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:79ad818f-f181-5cf4-b51c-d34f06c11c69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c4744f2a-8ab5-52d8-be88-e26e177a8480", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:21fcce46-c8ef-53d6-948f-e0859c1f2e59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:dd416ce2-ef6c-5fd8-9bc1-e40499c5b581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cf76a86b-1334-5e4a-8377-202860e7dd02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0183b66f-d90f-553f-8e84-e582b1420fcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d92de0af-9907-537d-a324-0ca9be605ef9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5e6f53cc-10d2-560f-9076-e9e32bc57c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b56bef34-4e8a-5905-8969-5aa7e2fd3947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ] }