BomLensSBOM
Open-source risk report

Open-source risk report

Project: SpringBootDemo · Generated:

1. Vulnerability analysis and remediation deadlines

Recommended remediation deadlines: Critical → within 7 days, High → within 30 days. We recommend preparing a remediation plan or risk justification.
Critical 8 High 35 Medium 35 Low 14 Unknown 0
SeverityCVEPackageInstalledFixedDeadline
CRITICALCVE-2025-24813org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.3, 10.1.35, 9.0.99within 7 days
CRITICALCVE-2026-41293org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22within 7 days
CRITICALCVE-2026-43512org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22within 7 days
CRITICALCVE-2026-43515org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22within 7 days
CRITICALCVE-2026-65182org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.25, 10.1.58, 9.0.121within 7 days
CRITICALCVE-2026-65905org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.25, 10.1.58, 9.0.121within 7 days
CRITICALCVE-2026-68525org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.25, 10.1.58, 9.0.121within 7 days
CRITICALCVE-2026-47884org.springframework:spring-webmvc6.1.17.0.9within 7 days
HIGHCVE-2023-6378ch.qos.logback:logback-classic1.4.111.3.12, 1.4.12, 1.2.13within 30 days
HIGHCVE-2023-6378ch.qos.logback:logback-core1.4.111.3.12, 1.4.12, 1.2.13within 30 days
HIGHCVE-2026-68494com.fasterxml.jackson.core:jackson-core2.16.02.18.8, 2.21.4within 30 days
HIGHCVE-2026-89425com.fasterxml.jackson.core:jackson-core2.16.02.21.7, 2.22.3, 2.18.11within 30 days
HIGHCVE-2026-54512com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 3.1.4, 2.21.4within 30 days
HIGHCVE-2026-54513com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 2.21.4, 3.1.4within 30 days
HIGHCVE-2026-68497com.fasterxml.jackson.core:jackson-databind2.16.02.18.10, 2.21.6, 2.22.2within 30 days
HIGHCVE-2026-91776com.fasterxml.jackson.core:jackson-databind2.16.02.18.11, 2.21.7, 2.22.3within 30 days
HIGHCVE-2026-91777com.fasterxml.jackson.core:jackson-databind2.16.02.21.7, 2.18.11, 2.22.3within 30 days
HIGHCVE-2024-34750org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.0-M21, 10.1.25, 9.0.90within 30 days
HIGHCVE-2024-38286org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.0-M21, 10.1.25, 9.0.90within 30 days
HIGHCVE-2024-50379org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.2, 10.1.34, 9.0.98within 30 days
HIGHCVE-2024-56337org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.2, 10.1.34, 9.0.98within 30 days
HIGHCVE-2025-48988org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106within 30 days
HIGHCVE-2025-48989org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.10, 10.1.44, 9.0.108within 30 days
HIGHCVE-2025-52520org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.9, 10.1.43, 9.0.107within 30 days
HIGHCVE-2025-53506org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.107, 10.1.43, 11.0.9within 30 days
HIGHCVE-2025-55752org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.11, 10.1.45, 9.0.109within 30 days
HIGHCVE-2026-24734org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.18, 10.1.52, 9.0.115within 30 days
HIGHCVE-2026-24880org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.116, 10.1.52, 11.0.20within 30 days
HIGHCVE-2026-34483org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.116, 10.1.54, 11.0.21within 30 days
HIGHCVE-2026-34487org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.117, 10.1.54, 11.0.21within 30 days
HIGHCVE-2026-41284org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22within 30 days
HIGHCVE-2026-42498org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22within 30 days
HIGHCVE-2026-43513org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22within 30 days
HIGHCVE-2025-22235org.springframework.boot:spring-boot3.2.03.3.11, 3.4.5within 30 days
HIGHCVE-2025-41249org.springframework:spring-core6.1.16.2.11within 30 days
HIGHCVE-2026-41850org.springframework:spring-expression6.1.17.0.8, 6.2.19within 30 days
HIGHCVE-2024-22243org.springframework:spring-web6.1.16.1.4, 6.0.17, 5.3.32within 30 days
HIGHCVE-2024-22259org.springframework:spring-web6.1.16.1.5, 6.0.18, 5.3.33within 30 days
HIGHCVE-2024-22262org.springframework:spring-web6.1.15.3.34, 6.0.19, 6.1.6within 30 days
HIGHCVE-2024-38816org.springframework:spring-webmvc6.1.16.1.13within 30 days
HIGHCVE-2024-38819org.springframework:spring-webmvc6.1.16.1.14within 30 days
HIGHCVE-2026-41842org.springframework:spring-webmvc6.1.17.0.8, 6.2.19within 30 days
HIGHCVE-2026-41845org.springframework:spring-webmvc6.1.17.0.8, 6.2.19within 30 days
MEDIUMCVE-2024-12798ch.qos.logback:logback-core1.4.111.5.13, 1.3.15Per policy
MEDIUMCVE-2025-11226ch.qos.logback:logback-core1.4.111.5.19, 1.3.16Per policy
MEDIUMCVE-2026-18401com.fasterxml.jackson.core:jackson-core2.16.02.21.1, 2.18.6Per policy
MEDIUMCVE-2026-19032com.fasterxml.jackson.core:jackson-databind2.16.02.18.10, 2.21.6, 2.22.2Per policy
MEDIUMCVE-2026-54514com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 2.21.4, 3.1.4Per policy
MEDIUMCVE-2026-54515com.fasterxml.jackson.core:jackson-databind2.16.03.1.4, 2.18.9, 2.21.5, 2.22.1Per policy
MEDIUMCVE-2026-59888com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 2.21.4Per policy
MEDIUMCVE-2026-59889com.fasterxml.jackson.core:jackson-databind2.16.02.21.5, 2.18.9, 2.22.1Per policy
MEDIUMCVE-2026-77310com.fasterxml.jackson.core:jackson-databind2.16.02.18.9, 2.21.5, 2.22.1Per policy
MEDIUMCVE-2026-83557com.fasterxml.jackson.core:jackson-databind2.16.02.18.10, 2.21.6, 2.22.2Per policy
MEDIUMCVE-2025-48924org.apache.commons:commons-lang33.14.03.18.0Per policy
MEDIUMCVE-2026-49844org.apache.logging.log4j:log4j-api2.21.12.25.5, 2.26.1Per policy
MEDIUMCVE-2024-24549org.apache.tomcat.embed:tomcat-embed-core10.1.168.5.99, 9.0.86, 10.1.19, 11.0.0-M17Per policy
MEDIUMCVE-2025-31650org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.104, 10.1.40, 11.0.6Per policy
MEDIUMCVE-2025-49124org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106Per policy
MEDIUMCVE-2025-49125org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106Per policy
MEDIUMCVE-2025-55668org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106Per policy
MEDIUMCVE-2025-66614org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.15, 10.1.50, 9.0.113Per policy
MEDIUMCVE-2026-25854org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.116, 10.1.53, 11.0.20Per policy
MEDIUMCVE-2024-23672org.apache.tomcat.embed:tomcat-embed-websocket10.1.1611.0.0-M17, 10.1.19, 9.0.86, 8.5.99Per policy
MEDIUMCVE-2026-41711org.springframework.data:spring-data-commons3.2.04.0.6, 3.5.12Per policy
MEDIUMCVE-2026-41721org.springframework.data:spring-data-commons3.2.04.0.6, 3.5.12Per policy
MEDIUMCVE-2024-38820org.springframework:spring-context6.1.16.1.14Per policy
MEDIUMCVE-2026-41851org.springframework:spring-expression6.1.17.0.8, 6.2.19Per policy
MEDIUMCVE-2024-38809org.springframework:spring-web6.1.15.3.38, 6.0.23, 6.1.12Per policy
MEDIUMCVE-2024-38820org.springframework:spring-web6.1.16.1.14Per policy
MEDIUMCVE-2025-41234org.springframework:spring-web6.1.16.2.8, 6.1.21Per policy
MEDIUMCVE-2025-41242org.springframework:spring-webmvc6.1.16.2.10Per policy
MEDIUMCVE-2026-22737org.springframework:spring-webmvc6.1.17.0.6, 6.2.17Per policy
MEDIUMCVE-2026-22745org.springframework:spring-webmvc6.1.17.0.7, 6.2.18Per policy
MEDIUMCVE-2026-41841org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41843org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41844org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41846org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41853org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Per policy
LOWCVE-2024-12801ch.qos.logback:logback-core1.4.111.5.13, 1.3.15Per policy
LOWCVE-2026-10532ch.qos.logback:logback-core1.4.111.5.34Per policy
LOWCVE-2026-1225ch.qos.logback:logback-core1.4.111.5.25Per policy
LOWCVE-2026-9828ch.qos.logback:logback-core1.4.111.5.33Per policy
LOWCVE-2025-31651org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.104, 10.1.40, 11.0.6Per policy
LOWCVE-2025-46701org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.105, 10.1.41, 11.0.7Per policy
LOWCVE-2025-55754org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.11, 10.1.45, 9.0.109Per policy
LOWCVE-2025-61795org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.12, 10.1.47, 9.0.110Per policy
LOWCVE-2026-43514org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22Per policy
LOWCVE-2025-22233org.springframework:spring-context6.1.16.2.7, 6.1.20Per policy
LOWCVE-2026-41848org.springframework:spring-core6.1.17.0.8, 6.2.19Per policy
LOWCVE-2026-41852org.springframework:spring-expression6.1.17.0.8, 6.2.19Per policy
LOWCVE-2026-22735org.springframework:spring-webmvc6.1.17.0.6, 6.2.17Per policy
LOWCVE-2026-22741org.springframework:spring-webmvc6.1.17.0.7, 6.2.18Per policy

2. License summary

Distinct licenses identified: 10 (see the NOTICE artifact for details).

License classification (copyleft strength)

Each component is also recorded in the SBOM with a bomlens:licenseClass property. An unrecognized license is left uncategorized rather than assumed permissive.

Network copyleft 0 Strong copyleft 2 Weak copyleft 7 Permissive 55 Uncategorized 0

Components that create copyleft exposure (network/strong, up to 10):

Outbound-license conflicts

Dependencies checked against the declared outbound license. Advisory only — it surfaces combinations that need a person to look, and makes no legal determination.

Apache-2.0

Incompatible 0 Conditional 6 Unknown 2

3. Next steps

  1. Prepare a remediation plan or risk justification within the recommended deadlines above.
  2. Keep and distribute the notice (NOTICE) together with the SBOM.