{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8907ea75-e82e-59d9-9305-f98e447f0ca0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1", "version": "5.3.13-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.13", "type": "library", "group": "org.springframework", "version": "5.3.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:d6e95202-e255-528e-a398-ee1233d32df8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.13 is not affected by CVE-2020-5397. The vulnerability, which allowed CSRF attacks through CORS preflight requests (especially with Chrome TLS client certificates), was fixed in upstream Spring Framework 5.2.3 (January 2020). The fix was already included in the 5.3.13 release before TuxCare onboarding. All required defenses are present: CorsUtils.isPreFlightRequest requires...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:9543838f-d44f-5648-9963-a10cf2890e94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-webflux. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:302af24d-5f0a-5715-8c99-c96dd5259a4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.13-tuxcare.5." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4e4971d8-6574-531b-b076-b9b0e34febfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:0bb2dd2c-49ed-54bc-93d5-4a65cad18237", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e23ac29e-aafb-5974-baf9-6fa3b6bd9a1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:62f61005-7b5a-5971-8d93-638d05db70f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:a7beae65-faec-5c7b-aeb7-c0e1bfa52e01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:f0e7f2a5-16de-54a8-be2a-ebcf62640d93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:aecaf5be-6f93-51e3-a073-6f9cf72c693b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:dfb526e3-4712-59d1-9ed5-c54ec6ceda70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:fcd0a139-ca03-5739-8311-c1a8538d2128", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:45fe2aff-fb0e-5286-9665-c079173ec5ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:1e1cebcb-6588-50e4-99cd-3bdca9052b34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.13-tuxcare.2." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e6302bc2-b147-5e1d-8ba4-889710d0b5f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.13-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:99149214-8489-519a-b232-f9455aff866c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.13-tuxcare.7." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e9ca9d9d-5624-5b25-bda3-b10c268f514c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.13-tuxcare.5." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:adea9373-01dd-5465-a20f-f62e82ed9449", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.13-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.13-tuxcare.6." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:86a0b149-ac5d-5a51-9338-1f5003e01e6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.13-tuxcare.4 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2. The CVE describes an open redirect vulnerability in UrlHandlerFilter when configured with broad patterns and processing URIs with double leading slashes (e.g., //path/). Since UrlHandlerFilter was no...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:2029048f-2a0c-59bb-8328-9bdc1e85dd4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-webflux. Target version 5.3.13 is not affected by CVE-2026-47890. The vulnerability requires SSE (Server-Sent Events) Fragment streaming functionality, which was introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.13 predates this feature entirely - the vulnerable code path does not exist. The CVE affects versions 6.2.0-6.2.19 and 7.0.0-7.0.8, all of which postdate the target version.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:d699f4f9-c5c2-5559-b9e3-d45818f2e8d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:7c340a47-f195-575e-9fbc-983773a3e371", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ], "bom-ref": "urn:uuid:66b7b861-d23b-5cd9-ac3e-f020b6e14cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.13-tuxcare.1" } ] }