{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:506f8798-f23c-512b-821d-3dd4566d8ff2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:0368b50f-854c-597a-8655-db3c021fb70f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2020-5397. The vulnerability, which allowed CSRF attacks through improperly validated CORS preflight requests, was fixed in upstream Spring Framework 5.2.3 (January 2020). The fix is present in version 6.1.16 through upstream commit bc7d010485 by S\u00e9bastien Deleuze, which added Origin header validation to isPreFlightRequest() and ensures all preflig...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:42e6b813-e05a-5ebc-b398-dbe3cfb57201", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 6.1.16 is NOT affected by CVE-2020-5398. The vulnerability involves a reflected file download (RFD) attack through unescaped quote characters in the Content-Disposition header's filename parameter. The fix (escaping quote and backslash characters) was introduced in the upstream Spring Framework by commit 41f40c6c22 (Dec 2019) and is present in the target at spring-web/src/main/java/org/springframework/http/ContentDisposition.java. The appendName() method (lines 615-629) properly escapes both quote and backslash characters before inserting filenames into Content-Disposition headers, preventing header injection attacks. This fix was already included in the upstream Spring Framework 6.1.16 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:c43156ee-9a72-58ad-ab60-b437832c3354", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:0658c823-7f68-5cae-a868-85ec935a329c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.1.13, and version 6.1.16 is a later release of the same line. Advisories: GitHub GHSA-cx7f-g6mp-7hqm (fixed in 6.1.13), CVE record (fixed in 6.1.13), Snyk (fixed in 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:fe1e9271-15c8-5ad4-9d99-2f0cc7031766", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. CVE-2024-38819 (path traversal via URL-encoded sequences in static resource paths) does NOT affect Spring Framework 6.1.16-tuxcare.7. The upstream fix commits (3bfbe30a \"Normalize static resource path early\" and fb7890d7 \"Update processPath for double encoding\", both authored by rossen.stoyanchev@broadcom.com on Oct 14, 2024) were already present in the upstream Spring Framework 6.1.16 release that TuxCare onboarded. All 4 affected files (PathResourceLookupFunction in webflux/webmvc, ResourceWebHandler, ResourceHttpRequestHandler) contain the normalizePath() defense that decodes paths (up to twice for double-encoding) and applies StringUtils.cleanPath() when \"../\" is detected, preventing encoded traversal attacks. The vulnerable pattern (checking for \"..\" on raw encoded paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:bf8f4954-49cf-5631-a231-803a6ca86b50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:28d033d1-752d-53a0-8d6a-fc2c278c160d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:6f238db5-eaa3-5d8e-bda2-dad6a423a92c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:427e76b4-7fe7-50b5-977b-af8d27e5f1fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:7d5ceb8c-c320-5943-a592-92bcdc62f6e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3266971f-188a-539f-9e11-c2925a9e622f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4bf3f310-93a2-5d18-bc86-6a145e3ea475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 6.1.16-tuxcare.6 of org.springframework:spring-webflux, and is fixed in 6.1.16-tuxcare.7." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4d39f04a-5355-5ae3-b7dc-020524d6272f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:2022b413-9aae-582b-800c-0843dc3e5735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:c71c9713-fc9c-5502-94e6-d6b966f02053", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.1.16-tuxcare.6 of org.springframework:spring-webflux, and is fixed in 6.1.16-tuxcare.7." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:59b10814-892d-5534-b66e-1571c9786965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:96257b3b-a093-5e8c-bafe-0dc5d0f44dda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2026-41847. The vulnerability was fixed in upstream commit 07ba95739b (April 24, 2021) which is present in HEAD. This fix was included in the upstream Spring Framework release that TuxCare onboarded, predating all TuxCare maintenance work on this version. Both affected files (CoRouterFunctionDsl.kt and RouterFunctionDsl.kt) cor...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:af06d3c8-f693-54a4-9d24-7b7f17f6cfd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:36bf0abc-af84-557b-813a-fc4d85672c00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced in Spring Framework 6.2.0 (May 2024). Version 6.1.16 predates the introduction of UrlHandlerFilter entirely and contains no equivalent trailing-slash redirect functionality that could be vulnerable to the double-slash open redirect issue.", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:e2df87a0-1d61-52a5-b75a-b3438c432806", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webflux. Version 6.1.16 is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r, \\r\\n) in SSE (Server-Sent Events) fragment rendering, which causes stream corruption. This SSE fragment rendering feature was introduced in Spring Framework 6.2.0 (commit 6e55e78b22). Version 6.1.16 predates this feature entirely\u2014the Fragment class, SSE fragment formatting code, and related infrastructure are completely absent from the codebase. The CVE's stated affected range (6.2.0-6.2.19, 7.0.0-7.0.8) correctly excludes 6.1.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:779ad80b-45f0-5d4f-8b13-557fa64b7d8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:29dd5097-bdd3-531b-8aea-ebe68cbac48b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:25c897bc-0a76-59e4-8817-ad0cf2138d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.16-tuxcare.6" } ] }