{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2715453c-fc7c-5465-99a4-fa0ffd441ee6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e634fe73-342b-5d70-9561-194a6544378e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9cb14a3a-b511-5c1a-a2c1-f4cee4343eba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:417bd34a-5b12-5b88-b318-9c08c1d3fd2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fd7723d1-6e48-5743-9921-d0f731ba8161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:04c2d9a8-a4fd-5d51-8817-9dbebdd13ac5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7019f836-7f62-5aa5-98e1-2e1c123326e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:03f12686-cce8-5fd5-bc42-5858606899a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3d956e7d-3c48-5e31-8c88-c8d5ccc0b555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:52302285-9d42-51d3-997d-335d783454ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:af3b847a-3a58-5ef3-989d-739fe5230776", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0095dfc2-29bb-56da-92e1-a27292a6a3a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:11d1ea3f-458a-512e-8299-99ee14f378a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e71b6019-d145-5979-a34a-a53632180ccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cae5fca0-77cd-5b41-a9c2-0b20092df13a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:44f42f9b-ffbb-50a1-ba87-2577899518b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1b3a2d62-7366-5cc1-b4a6-3f5f2edb44c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3ccc884e-1780-59ea-9898-a4d0b9aa5ed6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:089b58b4-f0d0-5e9b-b17d-cd34f42ede5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c4a4dda7-217c-55a8-a2b3-179806fbd877", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:454ee7e7-3473-5d1d-acd2-da69f1f05cd5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:770c4755-7aec-5f76-885a-ff7bd0cef3f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:536b3738-58fb-5087-a038-5f1f3b7dd6af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5a97f385-c7f9-5275-84a3-9b3d43759f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a512021b-5355-584a-a9c9-281475008ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:28c0077e-c383-5bf7-a877-653ac3f038ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:55930f7c-3c7c-5b03-892d-e1f4cf2588ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b696c825-3ad1-5f47-bce6-43d902f26a64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f9a1402a-549f-53c5-b0ea-96da59a99fb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:85107ba1-54b7-5328-8889-821cbf7e1b2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b130e556-8cea-5b23-9d3b-f289da801fe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:33124608-f4aa-5bd7-bb78-918ba3bd74eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f67c91df-c322-591e-9ca2-e84fa5da6c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ba5c5d4c-0225-5cfd-b1bb-af271ba367af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a4358771-9fe6-5012-a75d-4b6225d541e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:400332e9-10e8-5bb9-8648-4e4c162340ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b15168a5-a448-53e1-bd00-88904bf968d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:03275f04-dfe5-52c4-b441-ce1c21a65cfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:25c75c3d-dad6-56e6-926d-b4a1df28eeda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:25dcc1a1-ea6b-538e-a303-6f99decf5640", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:15fb1c7a-7667-5f15-9f5d-3a555287428a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a3d7da8f-9b9c-50ee-8972-7036670b13a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:86debb73-65d7-5d0b-a1da-c8fe80ee1299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ac03f4b4-0950-51e0-a06b-4b83d3b71b9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bbf7746c-cbb7-5fbe-a0c7-aa8e13615682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d5d4013d-1b09-52d1-bed6-8fe7ea3e7074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a8ccdb1a-ec10-54cc-85b3-a445d09525a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:17b4a2f2-8344-5058-92a2-08cde6597524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5786c0c4-aca3-5b39-853b-b4cd5797982c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-context-indexer." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.12-tuxcare.6" } ] }