{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7cf69e81-652b-5401-8d3d-b253ccf0da55", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13", "version": "6.1.20-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.20", "type": "library", "group": "org.springframework", "version": "6.1.20" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:4809e3a9-f7a6-57a2-af7e-2109d92fa1e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 is NOT present in Spring Framework 6.1.20-tuxcare.13. The vulnerability was fixed in upstream version 5.2.3.RELEASE (released 2020-01-13), and version 6.1.20 inherited this fix from the upstream release. The fix adds Origin header validation to CorsUtils.isPreFlightRequest() and ensures all valid preflight requests are processed with PreFlightHandler. All four key files (CorsUtils...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:3c3d9833-013d-5d85-bcee-564f1563066f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. CVE-2020-5398 (Reflected File Download attack via unescaped quotes in Content-Disposition filename) is NOT present in Spring Framework 6.1.20-tuxcare.13. The fix was already included in the upstream Spring Framework 6.1.20 release before TuxCare onboarding. The ContentDisposition class escapes quote and backslash characters via the appendName() method (lines 623-625), preventing header injection attacks. Fix commit 956ffe68 by upstream author rstoyanchev@pivotal.io was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:eb2deb47-f544-5a6c-abe4-1a7913d48339", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. Spring Framework 6.1.20 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:79c78b7d-0178-5f52-b73d-ce8164ed0b87", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. CVE-2024-38816 path traversal vulnerability is NOT present in Spring Framework 6.1.20-tuxcare.13. The upstream vendor (Broadcom/VMware) fixed this vulnerability in commit d86bf8b2 (2024-09-02), which was included in Spring Framework 6.1.13 and all subsequent releases including 6.1.20. When TuxCare onboarded version 6.1.20 on 2025-06-19, the fix was already present in the upstream release. Both PathResourceLookupFunction files (WebMvc and WebFlux) contain comprehensive path traversal defenses: path normalization, URL-decoding validation rejecting ../ sequences, and resource location verification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:49a64529-b5eb-5e7a-906e-f175d6b5c553", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. CVE-2024-38819 path traversal vulnerability is NOT present in Spring Framework 6.1.20-tuxcare.13. The upstream vendor (Rossen Stoyanchev from Broadcom) fixed this vulnerability in commit 3bfbe30a78 (\"Normalize static resource path early\") dated October 14, 2024, which was already included in the upstream Spring Framework 6.1.20 release before TuxCare onboarded it. All four affected resource handler files contain the normalizePath() defense that URL-decodes paths (handling double-encoding) and normalizes them before validation, preventing attackers from bypassing path traversal checks via URL encoding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:43c8e2ca-5838-5f1d-99df-7df8efcc342d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:db6a64ed-b696-5bb5-83a6-2d658e6b0d1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:941b9da5-d9f1-5589-bf92-494570a70590", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:5f148b97-fdcc-5328-925a-29568545616d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:2f3a2455-f601-59ff-8d4f-85e139d79281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:38c33a61-885d-5789-8a83-541049c3fd86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:a6653824-1644-569e-b9d1-790abac883c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:6779af64-e960-585c-bec4-5a586c4f9be6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:9ad4f857-1b74-5c6c-9ead-d4019566cad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:106c26c2-86a2-5b4e-b4e7-e32d9ee33889", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:6ad51c7b-681b-5253-9fea-b4b6853c7f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:3c14d97a-96ec-57c1-8f0a-33ac1f96da73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.1.20 is NOT affected by CVE-2026-41847. The vulnerability in the Kotlin Router DSL filter function was fixed in upstream commit 07ba95739b (April 2021) by ShindongLee, which was already included in the upstream Spring Framework 6.1.20 release that TuxCare onboarded. The fix correctly passes the modified ServerRequest from filters to downstream handlers instead of discarding m...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:f61181a7-7392-5c6f-a9f5-3eb290c62735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:7c784db2-1880-5d2e-9073-c4c4c10eac8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework version 6.1.20 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) was introduced in version 6.2.0-M2, which is after the target version 6.1.20. Exhaustive search of the codebase confirms no UrlHandlerFilter class exists, and TuxCare backport history shows CVE-2026-47883 fixes were applied only to 6.2.x versions (6.2.1, 6.2.3, 6.2.5, 6.2.7, 6.2.12-19)...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:a8ef4872-3836-5120-8b1b-8c7c850ed87c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-webflux. Spring Framework 6.1.20 is NOT affected by CVE-2026-47890. The vulnerability concerns improper carriage return (\\r) handling when rendering view fragments as Server-Sent Events, causing SSE stream corruption. However, the view fragments feature (Fragment class and fragment SSE rendering) does not exist in version 6.1.20 \u2014 it was introduced in version 6.2.0 (commits ef6a3768ee and 6e55e78b22, July 2024). The vulnerable pattern text.replace(\"\\n\", \"\\ndata:\") was added in commits 622c1b9e8c (Spring MVC) and 8e2b27e5d8 (WebFlux) in August 2024, when SSE fragment streaming was implemented. The CVE version range (6.2.0-6.2.19, 7.0.0-7.0.8) correctly excludes 6.1.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:2474fab8-e7b3-5c2e-95a4-f6195a4cc9d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:d93fb10b-c4ed-510a-a03a-04c3fca84b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ], "bom-ref": "urn:uuid:d44b8791-0a72-5242-9f24-44537aa39c3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.20-tuxcare.13" } ] }