{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:abc5e85b-8971-5c46-a431-380b561f5ef9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5", "version": "6.0.12-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b2ad022b-8853-548c-8323-dc317ed2f911", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.0.12 is NOT AFFECTED by CVE-2020-5397. The vulnerability affected versions 5.2.x prior to 5.2.3, which lacked Origin header validation in CORS preflight request detection. The fix was committed upstream on January 10, 2020 (commit bc7d010) by S\u00e9bastien Deleuze and was already present in the Spring Framework 6.0.12 release when TuxCare onboarded it. All affected components (Co...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:437b435d-84c4-5e61-8680-d931c1865630", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:2fa29731-54db-58d1-908f-48680e9b083c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-webflux. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:edf8dbd2-02c0-517f-a8cf-66473ca7accc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:e8008942-571e-5b7f-9526-242dbd3f9834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6a528519-d8c2-523c-93e6-f90bbddd712a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1ff5a842-8821-5629-9320-1d99d782e653", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:dd17c4f9-171d-50a3-a54d-26637d599d68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:4e65f3ed-0cfa-56b3-8458-37c40b7da83d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:7f55d3ac-e6e6-573e-a69f-865d797ee96c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ca8d63a6-f481-54ee-9a40-70d345415d02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-webflux. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:31a0c23d-910f-50fb-9914-cd06ddec64a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 6.0.12-tuxcare.5 of org.springframework:spring-webflux, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:8ce04458-48b5-55a7-be92-22f3ab7f2aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 6.0.12-tuxcare.5 of org.springframework:spring-webflux, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:11111340-5bd0-5f11-ad02-53815afbe747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:62e2c15f-3186-5d55-93a2-b9008c8c71fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.0.12-tuxcare.5 of org.springframework:spring-webflux, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:badd7f44-e9e9-564f-88a8-597e34316d58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:bf6de931-fdad-5b0e-849d-3aed8ef7b0b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.0.12 is NOT affected by CVE-2026-41847. The vulnerability was fixed in upstream commit 9d263668d5 (authored by ijonathanc on June 21, 2021), which was included in Spring Framework 6.0.0-RC1 and all subsequent releases including 6.0.12. The vulnerable pattern (passing the original request instead of the modified request parameter in Kotlin Router DSL filters) is not present in...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:27807b57-32e6-5360-94ef-a54393e8b0d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:2b7f1ad7-e141-5052-a84a-8c89dca1e007", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework version 6.0.12 is not affected by CVE-2026-47883 because the vulnerable component (UrlHandlerFilter class) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0-M2, which is a later release than the target version 6.0.12.", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:31f58e77-ec5a-530a-ba5a-30a90988e169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-webflux. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:9dd721b8-0e1b-5180-a92d-8c5a934ba80a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:af31b01c-5b86-54e8-bcae-4498da4ef392", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6be6431e-9ea2-5f5e-b890-6e21fb657ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.5" } ] }