{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b4813646-74e1-56bd-a1a0-d2ddf38e4eb1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3", "version": "5.3.21-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.21", "type": "library", "group": "org.springframework", "version": "5.3.21" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:a4e46e6a-e64f-5867-be15-e725f9f0f67e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 The target repository Spring Framework 5.3.21-tuxcare.6 is NOT affected by CVE-2020-5397. The vulnerability pattern (OPTIONS requests with Access-Control-Request-Method but without Origin header being incorrectly treated as valid CORS preflight requests) is not present in the target code. The fix was already included in the upstream 5.3.21 release that TuxCare onboarded, authored by Spring Fram...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:0ce5c1f3-fcd7-551c-96db-d6c96bbb3703", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.21 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:279d1211-197a-57a3-9bd6-79317ac6a805", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 5.3.21 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:06efeef2-5402-52bf-bc72-ccf3237e2813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:5f7deca5-5eef-51d1-8547-b17f13603465", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:51c60e02-0323-51f3-b5aa-68e8ccbb12ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:dbb4ecc0-41e1-5cf3-9461-5971516e504d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:1419daeb-10e6-5e30-be03-4a417321e13d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:5ba78a2f-d590-55d1-acfc-a6311233c81c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:3f24fa85-26ca-53a8-8080-275c09aabac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:cf8df1dc-fc5d-577f-9c81-ee16f6d89df9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:0626b53d-4075-503c-8fc3-cdc8222589db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:7a35d88c-d02c-5766-9c09-2d430513d59f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:023aa416-2475-5010-af38-6f31014feea9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.21-tuxcare.3 of org.springframework:spring-webflux, and is fixed in 5.3.21-tuxcare.4." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:3866a48f-becb-50f6-a7ef-9af378141870", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is already fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. Upstream ships the 41842 and 41843 fixes in one commit, and the earlier CVE-2026-41842 backport (44dbcce4ce) applied all of it" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:97a57892-0562-589b-b3a8-35c3a2a51aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:f7666375-7e81-5d19-a0b5-ad009a9c356b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.21 is NOT AFFECTED by CVE-2026-41847. The vulnerability (variable shadowing in Kotlin Router DSL filter function causing security modifications to be silently discarded) was fixed in upstream commit 07ba95739b (April 2021), which was included in the upstream Spring Framework 5.3.21 release (June 2022). The target contains the fixed code pattern where the lambda parameter `h...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:51c5e8eb-ab4e-55be-926c-c5569f9aa01f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:a0bf32e8-2571-5c32-8b19-3b809104dc80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.21-tuxcare.5 does not contain the UrlHandlerFilter class, which is the component affected by CVE-2026-47883. UrlHandlerFilter was introduced in Spring Framework 6.2.0-M2 (May 2024), well after version 5.3.21. The vulnerable code does not exist in this version, making it not affected by this open redirect vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:6b4cd50e-566d-5f7e-9a75-7b5e8fb0553c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.21-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 5.3.21 is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (`\\r`) when rendering view fragments as Server-Sent Events (SSE), but the SSE view fragment feature itself was not introduced until Spring Framework 6.2.0 (July-August 2024). Version 5.3.21 predates this feature by over 2 years. The vulnerable code paths (`ViewResolutionResultHandler.escapeSseFragment()` and `ResponseBodyEmitterReturnValueHandler.getFragmentContent()`) do not exist in 5.3.21. While 5.3.21 does support basic SSE via `SseEmitter`, its string escaping logic in `SseEventBuilderImpl.writeStringData()` already properly handles both `\\r` and `\\n` characters, using character-by-character iteration identical to the fix pattern.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:df53a524-d5e6-5512-af49-847bbb83664f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:d5243122-7416-58b0-a257-996c1845d908", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ], "bom-ref": "urn:uuid:8a1ff09c-eed3-5eca-9c3b-698b38c90bcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.21-tuxcare.3 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.21-tuxcare.3" } ] }