{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23e04250-51c5-5cc0-9d55-00562d022faa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4f6b6e8b-37a4-5fbf-8008-b5ab0b906cb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3ab63651-a1f9-536f-ab02-8fcf5638c726", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e213459d-42fc-562e-b37d-8fdd7d2842cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:98b29b6c-2a75-5b34-a3b5-a36095501e13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0cf27feb-a105-5e81-a346-ed3147f34884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f5e4f423-95a8-5d13-aa23-db635b92695a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:66d6e57b-3fd7-5eb4-9807-aef86ee42ae9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9f00f8cb-4697-5670-9ee2-1b92106bc6bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:71428f00-f443-5534-8ff9-0a997d2b2914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3b59a805-d246-59f3-a3ff-78a0f4701957", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:760f0afe-788a-5a73-b5f8-19bbfe3077da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c23cffb9-a010-5a31-baae-0639f2eb5a78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:642a38c3-a3b8-5fb9-9028-7dbb6361ceed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c0fd0318-f787-5648-9131-e53122f35838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:af55e514-bbbc-53f1-ac62-de38fe021d8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:15e84325-c9c6-5e05-b99b-6902fce75e93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8cac1ee8-6ecd-5a40-b587-9923c7a1af3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3fc107dc-b1ad-5e15-8f2a-faec23f79af9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3ac596a3-a9f8-53fb-b20a-d28cfd788ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:dd8ae91e-75ab-58a3-bea1-cdbe66648aac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a49f80bb-278a-5bbf-b708-2ca9d61b2786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:92504b7b-4b1f-586b-82e0-b5d3aacfdda3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bacb14fe-c8bc-5823-b83b-f38f62dd0ff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9ecf700f-4384-51f9-986e-b2f2bbbb4b3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0eb25b56-c5b3-57ee-a886-6d634dd10f31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:47830a32-7df0-5a92-b456-24fc102d17e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:45d29199-e1e0-5230-9945-ecfb00d19a96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5bd0ba3c-7879-5571-826e-c457afa3f156", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:37079f4e-8258-5be0-a168-938d38c2a58e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bdade227-efac-53f7-a1fc-e46018f8f94f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:622832c4-5ede-5815-b419-2c4ebe316234", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:40301683-2305-55a5-a0df-e1b0b06bbd33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1d6e8ba2-1de2-55d8-b2b0-5f41df847a31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4af28bad-c202-5be6-90cd-c33a1c34596c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:68473e88-0b50-5e47-9494-83c26d1f4988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7cf17b90-8325-5e79-a32d-ab2a169cba26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2ddcac9a-42af-5747-b400-bb56721cad09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a5e087d4-b1a5-5430-9667-526f6f0aa78a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4a679387-f7c1-5e5b-b77a-c77e08a62d5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9af40fb0-91b5-5f4d-8cde-0ed67ebefc55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:599279e9-5fbe-5605-a60c-38876e83127e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:878f1fd8-5a36-516e-a732-2e2c3fb4c393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:eac4e387-44f4-5d4a-bd9a-7361870afbb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7933f3fe-240d-584e-9c42-ec3437cfda50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:47e44aad-11f9-5b62-b525-426cb2ea3dc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:916e928f-ddc1-5577-a6be-2cf546f3a26d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0e33892c-c718-5351-9f8b-3056e2f029cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9a296f35-d50d-57e1-8e5d-ca16edd33ce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:42a4259a-e108-59ce-a68a-b73ec50f8943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:de4b3a25-fc3b-5f91-8596-38fec8919a80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.30-tuxcare.11" } ] }