{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2475db03-cb17-5218-9907-7238c106fb38", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2", "version": "5.1.18.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.18.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:81c6e456-68a7-5ab1-83f6-ed50a0467a9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE-tuxcare.2 is NOT affected by CVE-2020-5397. The vulnerability, which affected versions 5.2.x prior to 5.2.3, allowed CSRF attacks via malformed CORS preflight requests (OPTIONS + Access-Control-Request-Method header without Origin header). The target version 5.1.18 has never contained this vulnerable pattern. The 5.1.18 codebase requires the Origin header check t...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:75b40c9e-97b2-5f95-b69c-497212856b1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux. CVE-2020-5398 affects Spring Framework 5.1.x prior to 5.1.13. The target version is 5.1.18.RELEASE, which already contains the upstream fix (commit 6ce19ff86) that escapes quote characters in Content-Disposition filename attributes. The vulnerable code pattern is not present because the upstream vendor fixed it in 5.1.13, before this version was released and subsequently onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:549b15fa-163d-563f-af94-0054387194a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:567ecc6d-a112-5e50-9896-de996968258c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9c69f87-1120-542c-9652-b707847a09a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f5686c79-cd46-5ccd-aa55-cae6da3d6b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e96e3a60-20ff-5859-a4e8-f5823dcc5361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f97d63e8-c0f7-5518-912c-cd1f06ef6459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6af96d9c-0bd1-5d7b-b8d5-0884252b2861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0621749-9e21-51e6-bfb6-0c6904b66759", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e4bd5dc7-d300-5168-9b3f-5b7371735d4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9c1f2498-aa51-52c3-94ba-fea139cfc60d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f28a2348-657a-502d-97da-3effb6109c66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:420dda97-c7ef-5359-8ea2-17295b868d45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54f396ed-bdb7-52f9-aab7-b6421d14f55f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.1.18.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f834c5c8-e6eb-55b4-a685-cc47d4dd9e83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2aab1567-7ff6-5e29-9bb6-58f7a014222d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-41847. The vulnerability is specific to the Kotlin Router DSL filter function, which does not exist in this version. The filter function was introduced in Spring Framework 5.2.0.RELEASE (released after 5.1.18), making the vulnerable code pattern impossible to trigger in 5.1.x versions. While the target has spring-webflux and the Kotlin...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a5f6f4e-7ce0-5ab8-b114-beca5b9e85ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:943d335f-cf91-511b-b0f4-7ac20a231dce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version. UrlHandlerFilter was introduced to Spring Framework in May 2024, almost 4 years after version 5.1.18.RELEASE was released in September 2020. No alternative mechanism exists in version 5.1.18 that exhibits the same vulnerability pattern (taking request URIs...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1b5cef3a-9607-5f5a-ad8c-8bdb6dc02b8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47890. The vulnerability requires the view fragments rendering feature with SSE, which was introduced in Spring Framework 6.2+. Spring 5.1.18 does not contain the Fragment class, fragment rendering infrastructure, or the vulnerable code patterns described in the patches. While 5.1.18 does support basic SSE through SseEmitter, it cannot render view fragments as SSE events, making the vulnerability inapplicable to this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:352bd7af-8382-5895-86cd-501e70cfe7fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a54a1ce9-af5d-5f5b-9377-9fcc62a9b257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ed0bee10-e83a-5a83-acb3-08ac2c2519af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.2" } ] }