{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0bef1174-d940-5246-bcdd-fd167086e3fe", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework-docs", "purl": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "framework-docs", "purl": "pkg:maven/org.springframework/framework-docs@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ba8180d1-1ea4-5a3f-ae14-7c65ca8f3b51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5a86cf0e-06a6-5095-84ca-701eb8879a7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0424e21f-88ec-5199-8907-9cd51648a22b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2c798ef7-7ac6-55ab-b2ba-9b7ab1b02d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5ab338c5-51b8-5700-bc5e-6c95b764a327", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:80e27f96-b001-512f-8eb5-7685afb1bda3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:892f90cb-0aab-509f-b2fc-02a1a2267837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3f5ba976-614a-5380-bd89-6784bb6392fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e2f306f7-8716-541c-8d3e-9df7205822d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a660fa38-928b-53fd-acb2-f255716f4a69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ee78b361-1ee6-5b48-badf-280e2d896a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:964b187f-da5d-5b2f-92c3-cf8f02007a7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:943ec3a2-dcb1-5506-b5ca-a0ba3089c4c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:25885e59-44fe-5a64-aaa8-ca1d6baa316c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a7910f98-1641-53ff-ab17-caa2b436c696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2c8876ba-9695-5a30-8e3f-25199f9a0295", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:299e4577-cc12-50eb-8bf4-814ccae70d6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:93f89a23-f520-513a-a98f-4871177d590c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8e832579-e041-5cbe-8bb3-bd74b66b62ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ee801fe4-27ea-5ec2-b617-63f57fcb2134", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9b9fc747-9ae7-529f-85cc-87ab6786810f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fcfe6dd9-198f-5ba6-b089-e26e07d3f36e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fe1c7a0b-c6e9-58d3-a07b-5b567bfcf455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:827742c0-6b15-5148-a294-4f402c04636b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e675dd72-a636-51dc-a643-2ea787266c94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3821cd0d-a19b-5676-8501-ee1acd020164", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d9976182-b5ed-5170-8fdc-03e7522a47a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:193c9f8f-f8f1-5162-9df8-0a1b83b456b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d475a456-46c9-5957-b06e-b02794f408e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1f8c22d5-998c-53b0-92aa-cb20fa8e8189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:68a224e7-db19-55a4-a289-0504537909d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e9a8c83f-af3a-5ff2-aff6-38af3216461d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f5915726-135b-5afd-aa64-2ff967d983af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1684c04b-be47-5507-8492-1497484817db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e25d87a6-4841-5694-af1d-e5b5cf9826f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7edec0c3-e5c0-58b1-8858-7c96b3c8a34e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:825ca40b-82e2-5ef2-9f68-f36f9ba6758f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:119a1077-1e22-5b6d-878c-0536cf094e64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:framework-docs. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2878d241-0a49-5c8e-8757-c56380f76981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c1f907ba-dd56-5c1e-acf8-cdb42014382f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3d77ed2e-cfaa-5b73-92d5-0373909ae14c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fdc58aa7-aed2-509c-8739-5d86c5e4c18e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:42e7c237-eb83-5e54-9c1d-7fdcf9221197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0ded3118-d535-5e13-9d19-128b0a24d7b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:30b2a29e-f32f-5221-b61d-d4c81b863910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c88268ac-679d-5b00-b13f-68844958333f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f16d9c62-8366-58e4-bfcf-cf3de8679616", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:framework-docs." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/framework-docs@6.0.16-tuxcare.10" } ] }