{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d2efb08b-dff9-596b-baad-c39d45467c05", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "version": "5.3.19-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:e749ff03-e2a0-555e-aed9-f2388951ed0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target repository is Spring Framework 5.3.19-tuxcare.3. All components of the security fix are present in the target code: (1) CorsUtils.isPreFlightRequest() properly requires Origin header in both servlet and reactive implementations, and (2) AbstractHandlerMapping routes all preflight requests through PreFlightHandler for proper...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:85474320-9ed7-5bf3-9683-0fcfc1c993c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:c5721739-0915-575b-8e33-df33fd29a1c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 5.3.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:7c767691-9cb3-5d4f-af97-2ea2a394b52d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:d7e1c0e2-d63e-54ac-b9ce-164f869648c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:64d3ecbd-0fc8-598e-91d0-46ee86d1ca49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:fd653423-8346-5007-be43-c0ec50d23763", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:24e2741f-217e-5ba5-8acc-1b6903cff112", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.4." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:b77ff444-96dc-5eab-9a6e-27c474240de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:55c1b9ba-2015-5f3c-86b9-914ed6edec8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:843aa0e1-0700-5f74-90f6-80e02208742a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:b4eb0b70-00dc-5acc-8962-047ccf1e36db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:8b760f0b-dd62-5300-b328-b2c3a59660d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:8b25e8f7-e597-5901-8383-a45eeb5086b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:c2e05e4e-d002-5f40-a939-8b71049e9051", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:7a4d2c4f-0a0e-538a-91e2-a63d100616bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:c24a1246-5d7a-57d9-a9a3-7464ed50243e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:b991c554-9ee3-5914-9ac9-b47d42d11ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:2042861f-cb71-595f-a598-740ebf536e4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2 (May 2024, commit edb6bb717d). The target version predates this feature by a significant margin. No alternative code path in 5.3.19 implements the same vulnerability pattern of reading request URIs with double-...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:021a1e6d-6f8a-5f60-bf31-85e4f64b2332", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:6cd69d05-2f4d-527a-a323-efa5cac40af5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:e712b307-af93-53cf-adcf-2914585b45bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ], "bom-ref": "urn:uuid:48bdb326-ce51-5f15-a33e-aa93f49d278c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } ] }