{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:afe07708-0a1b-50a4-bb3c-e86bb3296be3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:62b46f90-09d2-5bcd-ab0a-9595c53258d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f8263385-cd33-58af-804a-58bf81536c8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bf73c01e-fd42-5bf0-a0a6-252955e76ed1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a0ecd722-ae56-5952-9c4a-85069f89e70d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9c936445-3e81-5636-b752-3eb78897ffcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:47a0f6c3-00dc-553f-897f-f7e0a0818fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1f899ac2-f5b8-5589-a17b-60165a396934", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:44ae18f4-8121-5ef9-93c0-6731700b4389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5db7903f-4705-5e11-8a79-99699627bf50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:92592524-58c0-583b-a359-1085d85b5c6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6fd70346-39a1-5652-8a81-a42dc95990cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fe7d8f1c-51b0-5df4-bb92-1a34c2dff7c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:aa599348-3d9f-518f-8ed7-fdf10e1b3916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1d949f57-2462-5ab5-a9c6-8089447736c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6ac2355a-fe6c-5b43-bdc8-9f68852336ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8ca49d1e-2dcb-5ce9-b7dc-80f05eac4b2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:df09d383-7ec8-54c7-920d-ecfdf2290723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:aad329dc-abe1-5328-bae1-7cf997dd43ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f861ac5e-0520-58fe-8a84-887fe6faa45d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e6af0053-70af-5560-ad42-64cabcbe8283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:da8bc8c3-23ee-5eb8-9f0e-d3662b8782d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8dd1c4b2-d3d5-50b1-9c3b-2eae9ea22663", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bbb8c41f-1666-5de6-b3dc-42723780d9c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ec6efddf-b999-5ad5-8b75-0cdf4f07852f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9dec822d-4bbc-5c92-8ff7-a56b0ad6bc06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:abaaf3a2-168b-53bc-9e5e-d01ccde55997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9b9ae8c5-d360-572c-9b3e-cf5260e22232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c9e35867-7f42-50d7-9a72-ff7e1513c2d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ba7c3ff0-e215-5344-ae7c-48a0e3b8c191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b9cb6fed-c18a-589d-9c4a-316f3a705f47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:25cee830-a706-55fd-bcf1-87c83c7c2d1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b3f3564e-55d8-5c4e-b06f-d8fcfc7724fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2dc338e4-05f4-5663-9382-816803224e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:aeedd79a-5f9e-53e8-bdf9-1e53ff22ba1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4f5bfd62-9d7b-5c7c-9fbb-22e721486b1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bf45438c-80a8-52f3-9453-0f5d8c006317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1591ffdf-f43d-5d99-9646-667eed2a37fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5a12ff96-2046-5c2a-ace4-903c77029c52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e383c843-b0b8-5254-9f7b-c788ffcdeca2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4f10b0e3-799f-5950-947d-323c1cc93749", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8494e3bb-1f66-5035-aeb2-cf7be6557dc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b26e64e5-519d-56bc-bb3c-54f005cfcab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2d8bbd7e-c95a-596f-8595-84d726fad240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.11" } ] }