{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0f1b56d7-dab7-5858-a2bc-493396d18fa6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5", "version": "5.2.25.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dffbfdf7-e12a-5b40-8b31-f356a2c16f48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 Target version 5.2.25.RELEASE is not affected by CVE-2020-5397. The vulnerability affected Spring Framework 5.2.x prior to 5.2.3. The fix was introduced in upstream version 5.2.3 (commit bc7d010485, January 2020) by S\u00e9bastien Deleuze. When TuxCare onboarded version 5.2.25.RELEASE, the fix was already present in the upstream release. All components of the fix are verified: (1) CorsUtils.isPreFli...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:741ae2dd-79d6-55c8-846c-50db987a51ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux. CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename) is NOT present in Spring Framework 5.2.25.RELEASE-tuxcare.4. The vulnerability affects Spring Framework versions 5.2.x prior to 5.2.3, but the target is version 5.2.25.RELEASE which already includes the upstream fix. The fix (quote escaping in filename parameter) was shipped in the upstream Spring Framework 5.2.25.RELEASE and inherited by TuxCare during onboarding. Current code at HEAD contains the `appendName()` method which escapes quotes and backslashes, preventing header injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0c5d87bb-f444-5df4-a2c2-1bd62360fb7e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux. Spring Framework 5.2.25.RELEASE already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:92541495-c413-5d21-8ef9-4784996c83ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:055b8ec8-7b03-56d1-887e-ecec48288632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d4e95abb-4030-5d9b-bbdd-252c79c50513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a3f9725b-d387-52bc-963c-f96784666843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6c304cf2-038f-5cd3-99bd-6c397ddb81ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:315c3d30-ea7b-5c70-8a40-33edc09c0d71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:09ddd626-7ecd-5456-848a-b4f2fc876b1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d82112d6-797e-563d-90bd-e6eb8cd81024", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f1942c9c-427b-59e0-9c48-8f1db875badc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:49cd35d2-2136-59a0-a135-0eafd9369250", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c8ba11ae-dd2f-5219-a831-a3585094a97b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3f146705-1247-5302-8970-e6de9f322ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9a132f5c-5b4e-568d-b9bf-aaee536e7dea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1723d894-cc95-58fb-b553-afa79b30ee35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4f060c2c-9c22-5b2d-ae6a-86fd24720cf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4055bf3a-4031-5c2b-8ef3-776d23fbad14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.2.25.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced in Spring Framework 6.2.0 (commit edb6bb717d, first appearing in v6.2.0-M2). The target repository contains no code that constructs redirect Location headers from request URIs with trailing slash handling, which is the specific functiona...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:41b842b2-99a3-5a3c-a8c3-01ce3f1bc0a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux. The target version 5.2.25.RELEASE does not contain the SSE view fragments feature that is vulnerable in versions 6.2.0+ and 7.0.0+. The vulnerable code pattern (incomplete line-ending escaping in view fragment rendering for SSE) does not exist in this version. While 5.2.25 has general SSE support via SseEmitter and ServerSentEventHttpMessageWriter, those components already correctly handle both \\r and \\n characters. The SSE view fragments feature was introduced in Spring Framework 6.2.0, by upstream commits 6e55e78b22 (WebFlux) and 622c1b9e8c (Spring MVC).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c1116406-9c46-526f-9e3f-644cc3424d8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:65e585a0-374b-5869-98ed-d157141d7c12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5585e546-81cd-5dcc-b974-08fe55480d8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.25.RELEASE-tuxcare.5" } ] }