{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4833fe4-8fbb-56e4-9015-2d58fd933832", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6f63785f-4d56-52a4-b65e-95b01590cdcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:90563718-df02-59dc-9ffe-20fa3f5ef77b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:144d7986-2c0a-5c6f-bc4c-d1fc6d195b1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:15eeef84-c90c-5404-9855-8aaa4f61e1bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:705e6078-9fea-5710-b28d-e53ba5fffe83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7858fd39-ee48-549b-ab4e-6dabfa0d2538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:46b8cebc-ab9c-5c33-a511-54197726e4c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e003a395-78a9-5865-ad91-ea77f1ad8b27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:173d1ef2-04fd-549f-a9df-cd84f646867c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:87085e84-c3d4-5c73-88bd-a3bf3a7b3d2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cd6fd655-7e1c-5971-b05f-ce5bc2213577", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d948ad9d-8f46-54fe-a322-f76f705a7024", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a4ccbf06-9f89-5979-9e3d-b9d8a013aaa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9f794eef-98d9-5f0c-83c6-d0aa2f3050b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:049839d1-e968-5dcc-ab7d-8170066cb4f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:49819a8d-4618-5f5e-b106-98c84c3f710c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:95ea4e1c-12b1-51c6-ab41-a470d630d874", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a27cc9fd-ac62-5503-91e3-5f004fde803e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f99c9ce4-c920-53ae-82ca-0389e9ec03b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:90537648-5781-5344-9a39-b926038e1207", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c10ca0de-0dcf-587a-b024-1c63ab9f84bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c55f90d9-176f-5287-b775-057dc90fc277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8c08370a-2108-5108-95aa-5e3608267e32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9f2a8eb0-c131-517f-8dd0-c5656ca3594e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:eadb8fc9-dbdb-50ee-ae52-ce5803c22120", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e7b6fc69-bc07-56c2-9779-10b8c6ea34e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:50629397-b851-5e47-af36-a4bc45d539d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:87bb64cb-4366-5b4f-ae0f-e4bf38e3dc07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2a657114-8a84-5e85-a7e5-fc1f416c1efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:49ce9492-0f30-598f-9c75-99adaa362318", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ac295dd6-43e3-512f-b176-4fa023b4312e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:fbd22531-7099-597e-a965-aee471e81d22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f9f3d112-f18d-5177-916e-378e97ef145b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1d96aa34-7a9f-599d-8d66-c02bbc199bfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9b94e023-84ba-5c9d-8be8-b36820d2732f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2fa88cb5-4cbd-5dac-b973-1869fe02332c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:211d8071-70da-50c1-bdaa-2021e1332b8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a374fa63-6a05-535d-aeb7-ea04ce42ac0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7943b7d6-ecfd-58bf-9806-5020b97e5a09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:01ee1df6-b47e-55d0-81a7-02f0d12a9bc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2052a042-1fd0-5d4c-8548-7ede869d0df9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.15-tuxcare.6" } ] }