{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:49117442-3d2f-5d65-8895-7df4b0534faf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1", "version": "6.2.14-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.14", "type": "library", "group": "org.springframework", "version": "6.2.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:db4a5bf2-5a9a-50eb-b450-3083ef5934bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target version (6.2.14) is significantly newer and already contains the upstream fix (commit bc7d010485 by sdeleuze@pivotal.io from January 2020). The fix was shipped in the upstream release that TuxCare onboarded in September 2026. All three components of the fix are present: (1) CorsUtils.isPreFlightRequest() requires Origin hea...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:00a8269b-37bf-58bd-80e6-16302f44c251", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 6.2.14 is not affected by CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename). The vulnerability affected versions 5.2.x < 5.2.3, 5.1.x < 5.1.13, and 5.0.x < 5.0.16. The upstream fix (commit 41f40c6c229d by rstoyanchev@pivotal.io, Dec 2019) that escapes double-quotes and backslashes in filenames was already present in the Spring Framework 6.2.14 release before TuxCare onboarding. The defense is implemented in the appendName() method at ContentDisposition.java:616-630, which prepends backslash to quotes and backslashes, preventing malicious filenames from breaking out of the quoted parameter value.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:9fb93ecd-996b-530d-82e4-75d2583f6f68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 6.2.14 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:a913dbb7-33aa-5cd2-9e4b-ae43648b8db4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-webflux. CVE-2024-38816 path traversal vulnerability is NOT present in Spring Framework 6.2.14. The upstream fix was already included in the Spring Framework 6.2.14 release before TuxCare onboarded it. The fix refactored path validation logic into ResourceHandlerUtils and added comprehensive URL-encoded path traversal defenses including double-decoding protection, normalization, and validation of both input paths and resolved resource paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:d996e5c0-bce6-50c6-9651-d883ef70659b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:160ea7f7-b1ab-5162-a426-a1a49a96082a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:89e57d5b-4523-568f-8712-a47131918513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:d0aed093-8214-5fab-b7b6-383c0c5ae307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:bc0be251-a00b-597a-ba7e-bcb47505979e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:c8d8c4b6-508a-5cb4-ba36-ad1d2fa041af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:76c3ca60-6666-5336-b6f9-3df1c47f2dce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:56cde5fa-5fde-57f0-ae93-f977a3a0e5b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:036003fc-b5c2-5a99-b9e1-3979a6234e59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:35e0be2e-6deb-5e82-ad6d-8cd8235ac193", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.2.14-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 6.2.14-tuxcare.3." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:a7727ac6-4c58-510e-b3b5-c08dbd277a29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.14-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 6.2.14-tuxcare.2." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:1ef46be5-406d-5e33-96d3-96f8ae868dae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:752e95ff-571e-5fef-a194-be07dd86e5fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 The target repository (Spring Framework 6.2.14) is not vulnerable to CVE-2026-41847. The vulnerability, which caused filters' modified ServerRequests to be silently discarded in Kotlin Router DSL, was fixed upstream in April 2021 (commit 07ba95739bf4451742e4ee6b4d4b2d0ee5f701bf). The fix was already present in the upstream Spring Framework 6.2.14 release that TuxCare onboarded in September 2026...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:0d7bc435-f6ea-5989-b278-87447208daa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:53f3ddc7-7560-57fd-a71e-74120ed65c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:3275edd0-9ab6-5d9d-ae85-6b7bbc9a3362", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:b58acd30-f6cd-50a0-bd89-69db83331861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:bb34066c-c559-5e91-833d-b00723d1b7fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ], "bom-ref": "urn:uuid:4c69cdf0-264c-51a3-86cf-b007a19871ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.14-tuxcare.1 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.14-tuxcare.1" } ] }