BomLensSBOM
Open-source risk report

Open-source risk report

Project: SpringBootDemo · Generated:

1. Vulnerability analysis and remediation deadlines

Recommended remediation deadlines: Critical → within 7 days, High → within 30 days. We recommend preparing a remediation plan or risk justification.
Critical 8 High 31 Medium 31 Low 14 Unknown 0
SeverityCVEPackageInstalledFixedDeadline
CRITICALCVE-2025-24813org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.3, 10.1.35, 9.0.99within 7 days
CRITICALCVE-2026-41293org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22within 7 days
CRITICALCVE-2026-43512org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22within 7 days
CRITICALCVE-2026-43515org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22within 7 days
CRITICALCVE-2026-65182org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.25, 10.1.58, 9.0.121within 7 days
CRITICALCVE-2026-65905org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.25, 10.1.58, 9.0.121within 7 days
CRITICALCVE-2026-68525org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.25, 10.1.58, 9.0.121within 7 days
CRITICALCVE-2026-47884org.springframework:spring-webmvc6.1.147.0.9within 7 days
HIGHCVE-2026-68494com.fasterxml.jackson.core:jackson-core2.17.22.18.8, 2.21.4within 30 days
HIGHCVE-2026-89407com.fasterxml.jackson.core:jackson-core2.17.22.18.11, 2.21.7, 2.22.3within 30 days
HIGHCVE-2026-89425com.fasterxml.jackson.core:jackson-core2.17.22.21.7, 2.22.3, 2.18.11within 30 days
HIGHCVE-2026-54512com.fasterxml.jackson.core:jackson-databind2.17.22.18.8, 3.1.4, 2.21.4within 30 days
HIGHCVE-2026-54513com.fasterxml.jackson.core:jackson-databind2.17.22.18.8, 2.21.4, 3.1.4within 30 days
HIGHCVE-2026-68497com.fasterxml.jackson.core:jackson-databind2.17.22.18.10, 2.21.6, 2.22.2within 30 days
HIGHCVE-2026-91776com.fasterxml.jackson.core:jackson-databind2.17.22.18.11, 2.21.7, 2.22.3within 30 days
HIGHCVE-2026-91777com.fasterxml.jackson.core:jackson-databind2.17.22.21.7, 2.18.11, 2.22.3within 30 days
HIGHCVE-2026-40984io.micrometer:micrometer-core1.13.61.16.6, 1.15.12within 30 days
HIGHCVE-2024-50379org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.2, 10.1.34, 9.0.98within 30 days
HIGHCVE-2024-56337org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.2, 10.1.34, 9.0.98within 30 days
HIGHCVE-2025-48988org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.8, 10.1.42, 9.0.106within 30 days
HIGHCVE-2025-48989org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.10, 10.1.44, 9.0.108within 30 days
HIGHCVE-2025-52520org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.9, 10.1.43, 9.0.107within 30 days
HIGHCVE-2025-53506org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.107, 10.1.43, 11.0.9within 30 days
HIGHCVE-2025-55752org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.11, 10.1.45, 9.0.109within 30 days
HIGHCVE-2026-24734org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.18, 10.1.52, 9.0.115within 30 days
HIGHCVE-2026-24880org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.116, 10.1.52, 11.0.20within 30 days
HIGHCVE-2026-34483org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.116, 10.1.54, 11.0.21within 30 days
HIGHCVE-2026-34487org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.117, 10.1.54, 11.0.21within 30 days
HIGHCVE-2026-41284org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22within 30 days
HIGHCVE-2026-42498org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22within 30 days
HIGHCVE-2026-43513org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22within 30 days
HIGHCVE-2025-22235org.springframework.boot:spring-boot3.3.53.3.11, 3.4.5within 30 days
HIGHCVE-2026-40973org.springframework.boot:spring-boot3.3.54.0.6, 3.5.14within 30 days
HIGHCVE-2026-22733org.springframework.boot:spring-boot-starter-actuator3.3.54.0.4, 3.5.12within 30 days
HIGHCVE-2026-41716org.springframework.data:spring-data-commons3.3.54.0.6, 3.5.12within 30 days
HIGHCVE-2025-41249org.springframework:spring-core6.1.146.2.11within 30 days
HIGHCVE-2026-41850org.springframework:spring-expression6.1.147.0.8, 6.2.19within 30 days
HIGHCVE-2026-41842org.springframework:spring-webmvc6.1.147.0.8, 6.2.19within 30 days
HIGHCVE-2026-41845org.springframework:spring-webmvc6.1.147.0.8, 6.2.19within 30 days
MEDIUMCVE-2024-12798ch.qos.logback:logback-core1.5.111.5.13, 1.3.15Per policy
MEDIUMCVE-2025-11226ch.qos.logback:logback-core1.5.111.5.19, 1.3.16Per policy
MEDIUMCVE-2026-18401com.fasterxml.jackson.core:jackson-core2.17.22.21.1, 2.18.6Per policy
MEDIUMCVE-2026-19032com.fasterxml.jackson.core:jackson-databind2.17.22.18.10, 2.21.6, 2.22.2Per policy
MEDIUMCVE-2026-54514com.fasterxml.jackson.core:jackson-databind2.17.22.18.8, 2.21.4, 3.1.4Per policy
MEDIUMCVE-2026-54515com.fasterxml.jackson.core:jackson-databind2.17.23.1.4, 2.18.9, 2.21.5, 2.22.1Per policy
MEDIUMCVE-2026-59888com.fasterxml.jackson.core:jackson-databind2.17.22.18.8, 2.21.4Per policy
MEDIUMCVE-2026-59889com.fasterxml.jackson.core:jackson-databind2.17.22.21.5, 2.18.9, 2.22.1Per policy
MEDIUMCVE-2026-77310com.fasterxml.jackson.core:jackson-databind2.17.22.18.9, 2.21.5, 2.22.1Per policy
MEDIUMCVE-2026-83557com.fasterxml.jackson.core:jackson-databind2.17.22.18.10, 2.21.6, 2.22.2Per policy
MEDIUMCVE-2025-48924org.apache.commons:commons-lang33.17.03.18.0Per policy
MEDIUMCVE-2026-49844org.apache.logging.log4j:log4j-api2.23.12.25.5, 2.26.1Per policy
MEDIUMCVE-2025-31650org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.104, 10.1.40, 11.0.6Per policy
MEDIUMCVE-2025-49124org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.8, 10.1.42, 9.0.106Per policy
MEDIUMCVE-2025-49125org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.8, 10.1.42, 9.0.106Per policy
MEDIUMCVE-2025-55668org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.8, 10.1.42, 9.0.106Per policy
MEDIUMCVE-2025-66614org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.15, 10.1.50, 9.0.113Per policy
MEDIUMCVE-2026-25854org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.116, 10.1.53, 11.0.20Per policy
MEDIUMCVE-2026-41001org.springframework.boot:spring-boot-autoconfigure3.3.54.0.7, 3.5.15Per policy
MEDIUMCVE-2026-41711org.springframework.data:spring-data-commons3.3.54.0.6, 3.5.12Per policy
MEDIUMCVE-2026-41721org.springframework.data:spring-data-commons3.3.54.0.6, 3.5.12Per policy
MEDIUMCVE-2026-41851org.springframework:spring-expression6.1.147.0.8, 6.2.19Per policy
MEDIUMCVE-2025-41234org.springframework:spring-web6.1.146.2.8, 6.1.21Per policy
MEDIUMCVE-2025-41242org.springframework:spring-webmvc6.1.146.2.10Per policy
MEDIUMCVE-2026-22737org.springframework:spring-webmvc6.1.147.0.6, 6.2.17Per policy
MEDIUMCVE-2026-22745org.springframework:spring-webmvc6.1.147.0.7, 6.2.18Per policy
MEDIUMCVE-2026-41841org.springframework:spring-webmvc6.1.147.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41843org.springframework:spring-webmvc6.1.147.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41844org.springframework:spring-webmvc6.1.147.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41846org.springframework:spring-webmvc6.1.147.0.8, 6.2.19Per policy
MEDIUMCVE-2026-41853org.springframework:spring-webmvc6.1.147.0.8, 6.2.19Per policy
LOWCVE-2024-12801ch.qos.logback:logback-core1.5.111.5.13, 1.3.15Per policy
LOWCVE-2026-10532ch.qos.logback:logback-core1.5.111.5.34Per policy
LOWCVE-2026-1225ch.qos.logback:logback-core1.5.111.5.25Per policy
LOWCVE-2026-9828ch.qos.logback:logback-core1.5.111.5.33Per policy
LOWCVE-2025-31651org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.104, 10.1.40, 11.0.6Per policy
LOWCVE-2025-46701org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.105, 10.1.41, 11.0.7Per policy
LOWCVE-2025-55754org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.11, 10.1.45, 9.0.109Per policy
LOWCVE-2025-61795org.apache.tomcat.embed:tomcat-embed-core10.1.3111.0.12, 10.1.47, 9.0.110Per policy
LOWCVE-2026-43514org.apache.tomcat.embed:tomcat-embed-core10.1.319.0.118, 10.1.55, 11.0.22Per policy
LOWCVE-2025-22233org.springframework:spring-context6.1.146.2.7, 6.1.20Per policy
LOWCVE-2026-41848org.springframework:spring-core6.1.147.0.8, 6.2.19Per policy
LOWCVE-2026-41852org.springframework:spring-expression6.1.147.0.8, 6.2.19Per policy
LOWCVE-2026-22735org.springframework:spring-webmvc6.1.147.0.6, 6.2.17Per policy
LOWCVE-2026-22741org.springframework:spring-webmvc6.1.147.0.7, 6.2.18Per policy

2. License summary

Distinct licenses identified: 11 (see the NOTICE artifact for details).

License classification (copyleft strength)

Each component is also recorded in the SBOM with a bomlens:licenseClass property. An unrecognized license is left uncategorized rather than assumed permissive.

Network copyleft 0 Strong copyleft 2 Weak copyleft 7 Permissive 60 Uncategorized 2

Components that create copyleft exposure (network/strong, up to 10):

Outbound-license conflicts

Dependencies checked against the declared outbound license. Advisory only — it surfaces combinations that need a person to look, and makes no legal determination.

Apache-2.0

Incompatible 0 Conditional 6 Unknown 3

3. Next steps

  1. Prepare a remediation plan or risk justification within the recommended deadlines above.
  2. Keep and distribute the notice (NOTICE) together with the SBOM.