{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:124c5a95-d7cb-58e2-8275-5c2aab9c7694", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6", "version": "5.0.13.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:77375b74-bb6d-52c4-9ea4-43d752f256be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Target 5.0.13.RELEASE is NOT affected by CVE-2020-5397. The vulnerability was introduced in Spring Framework 5.2.x when refactoring removed the Origin header check from isPreFlightRequest() and changed handler mapping to skip CORS processing for endpoints without configuration. The 5.0.13.RELEASE codebase never had this vulnerable pattern - it has always required Origin header validation via is...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:aa38a766-c418-5fc9-8824-095a0e5de198", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ac489c10-c737-5318-abde-707218acb537", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:54dc6dc1-cb5c-542f-92ec-d496c9bdc5d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ecfd6ce6-f412-5385-ade3-c6679dd445ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7feeacc5-af93-506d-9975-e15a73ffb950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:252d2435-1fb5-594c-ba3c-489a930a7002", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1af062bc-504c-5a22-9f33-18fbb3b30a22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7329d0a8-d7b3-5ed2-abde-0c937da7130c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:06da34bd-7340-553c-ad41-89730499e08f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2d791c91-a590-57db-b089-8bc1659c9374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:794deb8e-a709-5a87-a526-6c2ea1b69725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fdac7d6c-2046-5272-a6b3-472e7d84544c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:055ad5b8-bd63-5eab-90dd-aafbc0af4bbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:edeb0dc0-3c37-5b7c-9762-67db2450e064", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:88d76d76-0011-506b-9fa3-90b2b4f26aac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4a2c7e63-b705-522a-80b5-626010799e85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.0.13.RELEASE-tuxcare.1 is NOT affected by CVE-2026-41847. The vulnerable filter function in the Kotlin Router DSL does not exist in this version. The filter function was introduced in commit 1dfe304da4 (September 2019), first appearing in v5.2.0.RELEASE, which is after the 5.0.13 release. The vulnerability affects versions 5.2.0+ where the filter function exists with the para...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:30e8b1b4-9941-51d6-b467-9f6d8d158312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9e2a4cf2-b041-5a00-9bd8-6830f54877ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 CVE-2026-47883 concerns an open redirect vulnerability in `UrlHandlerFilter`, a component that was introduced to Spring Framework on 2024-05-15 (commit edb6bb717d). The target version 5.0.13.RELEASE (from 2017-2018) predates the introduction of `UrlHandlerFilter` by approximately 6-7 years. Exhaustive search confirms the vulnerable component does not exist in this version: no UrlHandlerFilter.j...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8c2b5f4e-e2e6-5a37-a7f9-3966779f90f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 5.0.13.RELEASE-tuxcare.6 is not affected by CVE-2026-47890. The vulnerability concerns improper line-break escaping in SSE (Server-Sent Events) Fragment rendering, a feature introduced in Spring Framework 6.2.0-M7 (August 2024). Version 5.0.13.RELEASE predates this feature entirely\u2014Fragment rendering for SSE does not exist in this codebase. Exhaustive searches confirmed no Fragment class, no view fragment rendering code, and no SSE+Fragment integration points. The target does have SseEmitter support for string data, which already includes proper CR/LF escaping (added via CVE-2026-22735 backport), but this is distinct from the Fragment rendering vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fc373cf6-59c3-5ae6-b3ce-b2748eb70830", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:42a234e7-8827-56ac-b156-aa855cf8ca27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47892 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 5.0.13.RELEASE is not vulnerable to CVE-2026-47892 as the affected code was introduced in 5.2.5.RELEASE (gh-24564, commit 6156900): in earlier versions a CORS pre-flight request never matches a functional-endpoint route, so the header predicate cannot be bypassed", "justification": "code_not_present" } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9d3ae5f7-f187-5766-860c-3152e37f53d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.0.13.RELEASE-tuxcare.6" } ] }