{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:73a0f628-b0ab-56f2-aa1d-1d19eaa4bd36", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2", "version": "5.0.19.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.19.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa3495f3-8105-5fc6-9fdb-d761819c3d9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.0.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:51423f5f-5b17-56b0-bf79-9153e9b24fc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux. CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename) is NOT present in target version 5.0.19.RELEASE. The vulnerability was fixed in upstream Spring Framework v5.0.16.RELEASE (January 2020) via commit 0583b334b4 by rstoyanchev@pivotal.io, which added quote-escaping in the ContentDisposition.appendName() method. Version 5.0.19.RELEASE inherits this upstream fix\u2014it was already present when TuxCare onboarded the version (first TuxCare commit d5717cf235c). The target's ContentDisposition.java (lines 414-428) contains the appendName() method that escapes quote and backslash characters before appending them to the header, preventing header injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:15f55efe-e5de-5a55-a260-a4a1eb11daf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab743fb5-4d9a-5161-8166-418c8953bff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70282f1d-e25d-586a-a117-68fe29e9150a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6aee8aaf-6106-5f40-abfc-d74c2fc08c13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9da3b144-0530-5a13-8850-99f0318f5786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cd2e58ed-7a74-5a02-b699-8c5505d8af30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.0.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5087969-9285-583b-9dd4-074eebcb86bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab9947a3-efa9-5e40-9704-00cc58a846c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a4d0918-7992-56fd-88ca-afc70ea3fd40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b1f9ab2-ef2e-51c6-9c74-958b807497a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Version 5.0.19.RELEASE uses the Synchronoss NIO Multipart library for reactive multipart processing, not the vulnerable PartGenerator/MultipartParser implementation. CVE-2026-41840 is specific to Spring's custom multipart parser (PartGenerator/MultipartParser) introduced in version 5.3.0 (June 2020). In the vulnerable implementation, BodyToken objects containing DataBuffers accumulate in Reacto...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27f4c3f0-4d23-5144-8e78-373f53c19683", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.0.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7cc64246-8440-56be-a7fb-5f21ccaa7cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.0.19.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd3633cc-25a4-53b5-8db8-fa1aa065dd67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c918ed8-ab1b-5054-9388-440046fd1518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4000f7cc-2c32-5487-96dc-7b2681577abb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.0.19.RELEASE is not affected by CVE-2026-41847. The vulnerable Kotlin Router DSL filter function does not exist in this version. The filter function was introduced in commit 1dfe304da4 (September 17, 2019) and first appeared in Spring 5.2.0.RELEASE (September 30, 2019). Spring 5.0.19 predates this feature entirely. Without the filter function, there is no code path where modi...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3ffcbc51-9246-5f6e-8988-581538a53e2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c8217162-60f6-58e4-a032-74a339fc3b50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.0.19.RELEASE does not contain the UrlHandlerFilter class that is the subject of CVE-2026-47883. UrlHandlerFilter was introduced in version 6.2.0 (first appearing in commit edb6bb717d and first tagged in v6.2.0), which is significantly later than the 5.0.19.RELEASE line. Exhaustive searches across the entire repository found no UrlHandlerFilter implementation in either the ser...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:628b37b1-b36c-5dd3-bff7-96106210eb0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.0.19.RELEASE is NOT AFFECTED by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) with view fragments\u2014a feature that renders HTML view templates and sends them as SSE events with incomplete line-break escaping. This feature was introduced in Spring Framework 6.2.0-M7 (July 2024), years after the 5.0.x release series. Version 5.0.19 does not contain the Fragment class, fragment rendering APIs, or the vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler.getFragmentContent()). Basic SSE string data handling in 5.0.19 already implements proper \\r and \\n escaping, but the fragment-specific rendering code does not exist.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9b56ed76-0be9-5019-9ddc-94479fb4a02e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ca1ba1d-2f98-5edc-b7fd-c5080c98c8ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47892 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.0.19.RELEASE is not vulnerable to CVE-2026-47892 as the affected code was introduced in 5.2.5.RELEASE (gh-24564, commit 6156900): in earlier versions a CORS pre-flight request never matches a functional-endpoint route, so the header predicate cannot be bypassed", "justification": "code_not_present" } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ef3cd165-e107-52b4-bf3f-738ea855edf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.19.RELEASE-tuxcare.2" } ] }