{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3e2bbebe-e098-5ed2-be93-2249d5eb6080", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:adbebcc9-db03-5b3a-a9d3-57d86b22d038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:37a595a8-1699-548d-9f60-6d346a45a481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:75e22676-97ab-54e5-a6ab-3f4e7e6e9be9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0e62e6b5-54d6-5adf-908d-acafea48043c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f5c8f480-b13a-5e59-9027-c0c6b586455e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:47f109ed-251f-58aa-81aa-0e3e0e5dcc3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6ef739b3-4d26-52ee-ba41-d6d7e27d4c86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b673b4dc-9bfb-57e9-b6bb-9f73be8e7ed2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6ef15749-a676-5c0e-b838-7bc92d96bd64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dc3fbf9b-600b-593d-88f3-331e180009a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4ce5a224-9eb4-5372-9792-9031498a4d42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:60195db9-7818-5f10-96d3-3de53b0f7a4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b58abdec-5dd4-584e-b5e4-610507a60a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:db7f0d21-056a-5912-945f-251a21f0f821", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cbb43dc5-f598-54d3-ada6-4cb19871b546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b717d85b-c584-5fe9-b1b9-bf3926701110", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:888c1cad-62df-5df1-a512-2e9fc59a3ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9313203c-7bb4-5768-9806-e3cc0c752e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2e7f0217-38a9-532e-ad9b-910212559e42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:81641890-09f8-5591-a460-9304bf4ce516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b99766e2-aa89-5a25-a577-5846d52f1a28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:27229d41-5d88-5b65-acc4-3fc30314ffc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ba32adb5-bba0-5a97-a85d-916148023123", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9b820570-166d-5c52-9f74-5b9d10bb6503", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:98e47ebd-074a-5335-8a38-1954e77bebad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2f4cbbbc-de2d-52c6-ae06-349284084542", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3e991039-268b-5d81-9fe8-87802d818242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:191be2c4-f17c-5aae-ab51-c184a4350bcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dd4291ff-df78-5394-b3f0-243f75c6b216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f5890261-7900-5009-bb73-3da3c432f601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:58c30840-7a97-5c27-bb96-d0c82d049cdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c0888a7e-9eca-5f46-ad87-0fc2b402ee52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:71660102-fcdc-5d54-b9ab-6c1598f71ab8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:351f8d1f-df28-59c5-9402-51a8211e16d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d5af7cde-edc0-5c32-bf64-ae995e1d5988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e0224ea0-1975-511a-851b-99ee75cc1ca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ccfb39d3-d7f6-5250-8877-e5f1d6da75ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6fea5423-87c1-58e0-8ddd-38a52ef8f159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e959039e-bed2-505b-8a22-f9d5cf155ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e6f61e96-7229-54b4-91c8-d3708ed519ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c71412e2-b180-55d3-9047-f4924e7684f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a579e486-e49b-5ab9-b79c-fb1902ef8acb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:79545a51-7991-5548-8050-92d5eeea0377", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.23-tuxcare.12" } ] }