{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b9df334a-711a-5743-8174-e7c03dc9862f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2", "version": "5.3.19-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:58fce006-080e-51fd-aa58-26cc3e8f6b33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target repository is Spring Framework 5.3.19-tuxcare.3. All components of the security fix are present in the target code: (1) CorsUtils.isPreFlightRequest() properly requires Origin header in both servlet and reactive implementations, and (2) AbstractHandlerMapping routes all preflight requests through PreFlightHandler for proper...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:8952724a-bbef-54fd-8bfe-f01df5258951", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:06032a97-c84e-5413-ae9b-2516bd7f5699", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.3.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9793dda5-3449-54ee-9f27-5bee7646f940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:cf18e32f-910b-527d-8844-2200cb4d18f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:556d3d2c-ae54-5a2e-9e72-2ce469631c13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:67a7c2fb-ee7d-5655-8d7a-107bf1055aa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:72b10d8e-827c-5fb6-af11-31d93050e752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.4." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:6b81a00b-ae3c-5399-9c37-2152833739e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9f041337-06fb-5500-bc1d-a60264e35dab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:7512ead2-594e-5336-8f25-2b5f1c79239b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9d1d54f7-34d5-5ea0-8f87-b04d010626df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:88da3d4a-ea95-5115-9ca8-a12200887abd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c7577130-c5c5-5564-bbf3-56258abe254c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3da4c704-88fc-5317-9b62-93ec46a460c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d5498247-7164-5325-bf25-103e7d63a062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:86a1aff8-1073-5b0a-9769-e00177ab73a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:8bea2212-3f2b-5aec-bd97-e16c5ef7d429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e9b7a557-a184-5b22-b9d4-ae26ba302824", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2 (May 2024, commit edb6bb717d). The target version predates this feature by a significant margin. No alternative code path in 5.3.19 implements the same vulnerability pattern of reading request URIs with double-...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:882d302a-5810-595b-8efc-a393e55aaa83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3e0b9b56-2fff-5a9f-9409-69485099269c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:f6b0f09d-fa5b-5938-8c64-155ae44b221a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d73281ab-7f3f-5244-9bf5-58c37e3e7879", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ] }