{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:05e0542e-8e9f-5dd1-82a3-60bdaffcb3ce", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11", "version": "5.2.13.RELEASE-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:ecec7822-dae7-5503-9639-87c61c464642", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux. not_affected \u2014 Target Spring Framework 5.2.13.RELEASE is NOT affected by CVE-2020-5397. The vulnerability affects versions 5.2.x prior to 5.2.3, and the fix was already present in the upstream 5.2.13.RELEASE that TuxCare onboarded. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) was shipped in Spring Framework 5.2.3 and is present in the target version. All key fix comp...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:8f1164b0-0911-5246-9637-1a3957a03dfa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux. The target Spring Framework 5.2.13.RELEASE is not affected by CVE-2020-5398. The vulnerability affects versions 5.2.x prior to 5.2.3, and the target version (5.2.13) already contains the upstream fix that escapes quote characters in Content-Disposition header filenames. The fix commit 41f40c6c by upstream author rstoyanchev@pivotal.io was included in the upstream 5.2.13.RELEASE before TuxCare's onboarding, implementing quote/backslash escaping in the appendName() method (lines 432-446 of ContentDisposition.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:78966c10-7bb2-581f-9654-d6293be2ca3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:0faf0b4a-14bf-5103-bb4c-2f60c8f7e324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:291ab3ba-e819-5a32-9d58-d72801bcf716", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:a125155f-60f9-5e36-8bc3-4e458e059692", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:e5f7ecaa-40d0-5606-aa13-db871e93d143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:c9b6f385-cb34-5189-850b-4f6713f02bd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:e9c25c72-405f-5e3d-a9d5-a37759abcb52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:a3af6408-412d-5982-871f-853e41a25ab4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:3347c99c-86ec-59ff-af02-98baf54d8df3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:514b3a99-47a2-55a9-a86d-285c29d1b1ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:6c149caf-0d62-5845-83ac-cb324f61834a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:6308081c-ccdb-5979-9978-5a561a41d811", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:d98be1c6-c445-5921-b790-21e72c51cad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux, and is fixed in 5.2.13.RELEASE-tuxcare.12." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:f82395a5-4eeb-530f-afd7-3b1251e716de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:93210330-f3a1-555c-83b1-b9373f129aae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:92f6e9bb-6ece-5af1-9f55-36fa6abca4a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later.", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:6bdf1697-4fc1-56ef-8804-bbe76ca4d93f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux. not_affected \u2014 CVE-2026-47883 affects UrlHandlerFilter, a component introduced in Spring Framework 6.2.0 (May 2024). Target version 5.2.13.RELEASE (released ~2020) predates UrlHandlerFilter by approximately 4 years. The vulnerable component and its automatic trailing slash redirect functionality do not exist in this version. While the target processes HTTP request URIs (input present), no code path exists tha...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:d854e757-32cc-5537-b6a1-0930201ecef7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux. Spring Framework 5.2.13.RELEASE-tuxcare.11 is not affected by CVE-2026-47890. The vulnerability requires the Fragment view rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.x and 7.0.x and does not exist in version 5.2.13. The target version has basic SSE escaping already protected via CVE-2026-22735 fix, but lacks the vulnerable Fragment rendering code path entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:3e123594-7ffa-5921-bffe-935e241464a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:16b435aa-f212-5276-98c6-78cf14cc40ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:3515e149-9006-5831-aeb0-f7e8daf8dcf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.11" } ] }