{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:503439e2-b9ea-562b-9b2d-db66f479b6f7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1", "version": "5.3.9-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.9", "type": "library", "group": "org.springframework", "version": "5.3.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:962dbffe-b538-50b4-9d6b-4e3d852c1ea1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 is NOT present in Spring Framework 5.3.9. The vulnerability allowed CSRF attacks through malformed CORS preflight requests (OPTIONS requests with Access-Control-Request-Method header but missing Origin header). The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) was already included in the Spring Framework 5.3.9 release that TuxCare onboarded. A...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:17b4db4c-3d7a-5dfc-8050-35803e1df01d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-webflux. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.3.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:f2ba9fa2-6edb-52fe-950b-1dbfa801f568", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:b2e6528f-dc57-52a5-a069-3f64bd622c37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:c990df25-a7f3-5b08-b93a-01498d9da061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:a665b02e-93e6-5ab6-bf2b-75bcecb5024f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:93ebaa42-1b21-5f78-bb8d-108b25dbd128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:5cd5be8a-d6bc-520b-bbf6-e6521e155b27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.9-tuxcare.5." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:59537fdd-7e23-5586-803b-ae6b1db27348", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:f32c5d3f-ff9e-5fde-b37e-42ed5caa4a8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:6c749f16-b97f-5953-8e5f-ef0331a16d70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:63e2c404-3801-50d7-a755-99b45dc4a9c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:8160bada-9d21-5920-8b48-c493d1d70dd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.9-tuxcare.4." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:05bf1384-c176-5f1d-8fc5-a97007577285", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.9-tuxcare.2." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:22cc838b-017c-537d-af57-1f8cfb9f56b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.9-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:d7342239-e3b1-5349-9267-1445abece1f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:25bd1741-6329-5704-80fd-c3605ff53ae9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.9 is NOT vulnerable to CVE-2026-41847. The vulnerability (Kotlin Router DSL filter silently discarding modified ServerRequest) was fixed in upstream commit 07ba95739b, which is included in the upstream Spring Framework 5.3.9 release. Both affected files (CoRouterFunctionDsl.kt and RouterFunctionDsl.kt) correctly use the handlerRequest parameter passed to the next handler fu...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:3d8447be-d53d-591c-82ae-5b0c10bb43c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.9-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.9-tuxcare.4." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:024e78f3-746d-54e9-9179-d59109edbf3e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.9 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.x in May 2024 (commit edb6bb717d), well after version 5.3.9 was released in 2021. This version uses javax.servlet.* packages while UrlHandlerFilter requires jakarta.servlet.* (Spring 6+). No alternative mechan...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:28bc7a07-b671-506c-8dd1-b4ccd58734e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.9-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 5.3.9 is not affected by CVE-2026-47890. The vulnerability is specific to SSE view fragment rendering, a feature introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.9 predates this feature entirely\u2014the Fragment class, fragment rendering infrastructure, and vulnerable SSE fragment formatters do not exist in this codebase. The vulnerable code pattern (inadequate carriage return escaping in fragment SSE events) cannot manifest in a version that lacks fragment support. Standard SSE handling in 5.3.9 (ServerSentEventHttpMessageWriter.java) already contains proper CR/LF escaping, but operates on a separate code path.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:460c5d70-b18e-56bb-85a4-7c44740a4337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:6acfaf08-376b-5b1c-a1fa-0e5fe10166a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ], "bom-ref": "urn:uuid:b62d7cf7-4f75-5ed4-bc44-d3f4fbef18b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.9-tuxcare.1 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.9-tuxcare.1" } ] }