{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1d47dc66-3c15-5ce3-aeab-56b4977fa6d0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5", "version": "5.2.15.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.15.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:74e34523-01a6-5147-ad9c-37aa0c523ceb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 is NOT present in Spring Framework 5.2.15.RELEASE. The vulnerability was fixed in upstream version 5.2.3, and the fix is present in 5.2.15.RELEASE which was onboarded by TuxCare. The fix adds Origin header presence validation to CorsUtils.isPreFlightRequest() and ensures all true preflight requests are processed by PreFlightHandler, preventing CSRF attacks through incomplete CORS ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c5d42ec8-79c5-522f-a01d-9738e4a05d15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux. The target version 5.2.15.RELEASE is not affected by CVE-2020-5398. The fix for this reflected file download (RFD) vulnerability was implemented by the Spring Framework team in version 5.2.3 and is present in the upstream 5.2.15.RELEASE that TuxCare onboarded. The defense escapes quote and backslash characters in Content-Disposition filename parameters to prevent header injection attacks. The fix was authored by the upstream Spring Framework team (rstoyanchev@pivotal.io), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3a5b004c-c3e8-5129-9f33-7a86a7adf6f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d124b8a4-3a8f-5b27-a65f-ca93f1953bba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:01b08d0f-2cad-5f41-9f88-551c359f11e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:41f17885-4391-5830-a48c-91d66bc0d9b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e3e36566-5888-59a0-bf1f-8763df27998f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c25439fa-ec2b-59e6-9aac-17b63ef80e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dc9beea6-c71b-51a8-8931-94aa5846e7c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:682a5dd1-f1c5-5c6d-b2ff-20fefe240a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:20db6c0f-51ce-50e3-9dac-ab56df6b0a28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:086f1caa-5332-58ab-bbcb-7695948cea61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2e26b5a9-6404-5e94-b917-dfcfb8f7d191", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:87d08809-4483-553d-966d-8be5a35a1d61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:126d04c7-0e52-57a3-a565-1dabf6d2c72d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ac41b17c-320f-5142-aee3-fb08f9509019", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b324f80b-e8d0-511b-a1a0-7bf6749dfa4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 5.2.15.RELEASE is not affected by CVE-2026-41847 because the upstream vendor (Spring Framework) had already applied the fix in this version before TuxCare onboarded it. The vulnerability pattern (filter lambda capturing outer scope's serverRequest instead of accepting it as a parameter) is not present in the codebase. Fix commit 3ab270e0f1 by shindong.lee@riiid.co wa...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b8e6cca1-3924-5232-a8b8-3810adab4845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1421afcb-6a6b-5175-85be-e18d36c3b25d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.2.15.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter was introduced in Spring Framework 6.2.0 (May 2024) and does not exist in version 5.2.15.RELEASE. The vulnerability concerns an open redirect flaw in UrlHandlerFilter's redirect logic when handling URIs with leading double slashes. Since this class and its associated functionality are ab...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c7ec0764-e2c0-546a-a6de-6df48a6aabef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux. Spring Framework 5.2.15.RELEASE is not affected by CVE-2026-47890. The vulnerability requires the Fragment rendering feature with SSE support, which was introduced in Spring Framework 6.2.0 (July 2024), more than 3 years after the target version 5.2.15.RELEASE was released (May 2021). The Fragment.java class, FragmentFormatter, and related Fragment SSE rendering code do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c34dbd04-475e-5a12-9139-9621e5c591f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:308d39b1-6e56-54ee-8ad2-445e5fec8773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1db16ec1-a426-59c6-941a-03ecd188e39f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.15.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.15.RELEASE-tuxcare.5" } ] }