{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d0a5ce0f-8d5f-5812-94c2-a5caf00257fc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6", "version": "6.2.1-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.1", "type": "library", "group": "org.springframework", "version": "6.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:9e6c1f37-ba16-5a54-9bd6-d6c22f5107dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 is not present in Spring Framework 6.2.1. The vulnerability allowed CSRF attacks via malformed CORS preflight requests (OPTIONS with Access-Control-Request-Method but without Origin header) that bypassed validation. The upstream fix was committed by S\u00e9bastien Deleuze on 2020-01-13 (commit bc7d010485) and shipped in the Spring Framework 6.2.1 release that TuxCare onboarded. All thr...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:e2e0b066-4dea-566b-a9ea-092d65c5715a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webflux. CVE-2020-5398 is not present in Spring Framework 6.2.1. The vulnerability affects versions 5.2.x prior to 5.2.3, 5.1.x prior to 5.1.13, and 5.0.x prior to 5.0.16. The upstream fix (commit 41f40c6c22) was already included in the Spring Framework 6.2.1 release that TuxCare onboarded. The appendName method properly escapes quote characters and backslashes in filenames before writing them to Content-Disposition headers, preventing header injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c7771d76-6e2c-52c8-9de2-59e639c95702", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 6.2.1 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:960c1db4-e00b-576b-b444-9048954c77c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webflux. The target repository (Spring Framework 6.2.1) is not affected by CVE-2024-38816. The path traversal vulnerability was fixed in upstream commits d86bf8b205 and c6fa180602, which were already part of the upstream 6.2.1 release before TuxCare onboarded it. The fix prevents path traversal attacks by decoding URL-encoded paths and validating them for traversal sequences (\"../\", \"..\\\") before resource lookup. Both WebMvc and WebFlux functional router resource handling are protected via the ResourceHandlerUtils utility class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:33a59627-4669-502f-be6f-baf04fc2bd48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:11f5198d-0035-578f-a4d5-7b78b9bfce28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c9cff665-7c76-55e7-999c-0d35701f08a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:07d759da-133d-51ac-a91f-afd82979bb5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:04ad8e69-2aea-5ed7-b193-362a9d1f8799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0de8d9bb-f7c5-50c0-a3a3-7740626ee839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:9519556e-a398-55c1-b252-4f39f633b93e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:68ec9594-6537-5514-9c98-f17fae529d0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:e1f61520-6cd8-5484-afa0-c0af2fd32df0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:d34e07d1-f531-5baa-a2e3-7a219da26f60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:6fe414c4-e8e0-5a07-8429-4943f20b3378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0c667843-643d-5bdc-b071-8c0e759d3ab0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:4684b5f0-449c-5bba-be89-3315eeaff9b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.2.1 is NOT affected by CVE-2026-41847. The vulnerability (parameter shadowing bug in Kotlin Router DSL filters causing security-modified requests to be discarded) was fixed by upstream Spring before version 6.2.1 was released. Three fix commits from April-June 2021 (07ba95739b, 3ab270e0f1, 9d263668d5) authored by upstream contributors corrected all affected filter functions. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c3d29a8a-3955-5fb3-b733-6a6e9cdcba38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:4155396f-c900-5940-b7ae-fbf4e33b106c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:8009d465-d90b-5031-abab-67ff1526d5cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:4cdf6310-c5bc-5825-8324-0f5cad3204a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1c6e9157-0995-5c27-b504-d5eeedc92169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c80af86b-b472-50e4-a56d-90fd70d794cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.1-tuxcare.6" } ] }