{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:96c4c67c-e8fd-5a39-b93d-fe24cdd28140", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8", "version": "6.2.15-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.15", "type": "library", "group": "org.springframework", "version": "6.2.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:a38598ca-d49f-5e89-9ee6-f8b9bee8438d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 is not present in Spring Framework 6.2.15. The vulnerability allowed CSRF attacks through malformed CORS preflight requests (OPTIONS with Access-Control-Request-Method but without Origin header). The fix was committed upstream on 2020-01-10 by S\u00e9bastien Deleuze (sdeleuze@pivotal.io) and was already included in the upstream Spring Framework 6.2.15 release that TuxCare onboarded. Bo...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:c0109e0d-0659-50eb-a575-7b896e56afbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webflux. The target Spring Framework 6.2.15-tuxcare.8 is NOT AFFECTED by CVE-2020-5398. The vulnerability (unescaped double quotes in Content-Disposition filename parameter allowing header injection) was fixed in upstream commit 41f40c6c by Rossen Stoyanchev (rstoyanchev@pivotal.io). This fix was already present in the upstream Spring Framework 6.2.15 release that TuxCare onboarded (commit 530f923fc0 by evasilev@cloudlinux.com on 2024-11-02). The defense code (appendName() method at lines 616-630) properly escapes both double quotes and backslashes before serializing filenames to HTTP headers, preventing the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:28742b67-a82f-5ad5-97bb-a6ff71436843", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webflux. Spring Framework 6.2.15 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:429e7454-4f44-5e7b-9378-c4306ee2c36b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webflux. Spring Framework 6.2.15 is NOT vulnerable to CVE-2024-38816 (path traversal in RouterFunctions static resource handling). The upstream Spring Framework 6.2.15 release already shipped with the complete fix authored by rossen.stoyanchev@broadcom.com in commit d86bf8b2056429edf. TuxCare onboarded this version with the fix already present; no backport was needed. The defense validates and decodes URL-encoded paths to detect path traversal sequences (e.g., %2e%2e%2f \u2192 ../) before resolving file resources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:ecf2bab2-9039-5553-9d9e-7fe060cd6136", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webflux. Version 6.2.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-g5vr-rgqm-vf78 (affected below 6.1.14), CVE record (affected up to 6.1.13), Snyk (affected below 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:558fe4ec-47ff-5f25-8d74-2332ad93c584", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:fda7e6b1-8d83-5b6b-b511-16b098e71cae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:d7bee3d3-0249-5395-966d-0a3ce6f70ad4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:808bb698-1079-533b-a47b-97f20b4d6ae2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:c2e19456-338e-5276-967b-2e8999103b02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:aa707b0e-e26b-5195-a81e-ad2e10cf0929", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:9c948242-036e-5d4f-bc40-91bd6e3f5ffb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:2bc05ca3-042c-5de6-bcb0-194cc82b446b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:cd3036a7-e4b4-50d7-8ce9-90313734d801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:567e99e5-a0a0-5b6e-b9c5-efaa47567725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:670f1a7e-7d2b-5dc1-b824-794dcd182754", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:ce3ecb01-54e9-59cf-aadc-837165410eb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webflux. not_affected \u2014 CVE-2026-41847 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability (Kotlin Router DSL filter silently discarding modified ServerRequest) was fixed in upstream commit 07ba95739bf before the 6.2.15 release. All three affected files (CoRouterFunctionDsl.kt, RouterFunctionDsl.kt for webflux, and RouterFunctionDsl.kt for webmvc) correctly use explicit lambda parameters, ensuring m...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:8cd4d518-5aa5-53e7-a1b8-f280e89f71a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:ca8244c4-5b31-5ced-ae9f-dce76999d94f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:f6be7455-df3e-566b-917e-dd08f945f89e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:7de8e847-18f6-5547-9737-ae881933f57e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:bdd0ca6f-db97-540f-b02d-fa031e34abce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:fc7c19cd-43d5-5437-8a76-12669927d38d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.15-tuxcare.8" } ] }