{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d9d02df1-870d-5965-8c5c-1c4f1d33c0a8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1", "version": "5.3.19-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:3c17812d-8bef-5521-87e7-eb5516d6d5fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target repository is Spring Framework 5.3.19-tuxcare.3. All components of the security fix are present in the target code: (1) CorsUtils.isPreFlightRequest() properly requires Origin header in both servlet and reactive implementations, and (2) AbstractHandlerMapping routes all preflight requests through PreFlightHandler for proper...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:87ce1ee5-adb7-5522-add0-7973f1980346", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webflux. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:099abb79-2351-569f-9199-00e054891211", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 5.3.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:527bc15d-f75f-5933-afa2-94a721491244", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:3e963cc4-d433-5e6c-b7f1-6ecdaad077c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:77b12662-ff98-5d5f-afa0-3221bf1e5380", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:d8af4da1-25b3-5c54-a360-ea373f438443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:52c89b2a-0676-56bd-93ab-3b88d77f6a59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.4." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:8a85f5f0-d9f1-50d1-a678-f5c6c614fd3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:51cdbba8-e8ea-500d-931c-5f8ac71ef78c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:789769f8-6782-54e0-91e3-c1b6c741e36d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:5010af2a-c89d-52c5-9017-14b62488b24a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:5e2462ce-cc4f-55f8-9581-400723782da9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:afc90998-e1a2-512d-8d97-09257f72d808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.2." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:e87173c5-5ff7-5b53-903f-5758938fb717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:7143e537-7503-5a66-9fc6-9cb498d9baca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:77c4eeaf-bb56-509d-95a9-4c98e6cf14b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:ba60273d-bdfc-5e85-9162-41ea27faa4c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:d7c59e9a-3b38-5b83-997e-291cadc86f3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2 (May 2024, commit edb6bb717d). The target version predates this feature by a significant margin. No alternative code path in 5.3.19 implements the same vulnerability pattern of reading request URIs with double-...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:eb8f26aa-455f-5b7b-85a5-07ffc8cfd7e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:46de407f-6641-5fa3-9020-ba08afada509", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:dac56013-b9f2-5457-a70f-d98a093ba69c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:08cad454-c2e4-5716-8483-4d3f2b7f7dfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.1" } ] }