{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ba395e28-5d67-5162-b673-e745b8096917", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15", "version": "6.1.21-tuxcare.15", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.21", "type": "library", "group": "org.springframework", "version": "6.1.21" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:7be935cf-1209-5204-aa89-2e4c89d15d78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 is NOT present in Spring Framework 6.1.21-tuxcare.16. The vulnerability pattern (OPTIONS requests without Origin header bypassing CORS validation) has been fixed by upstream commit bc7d010485. This fix was already included in the upstream Spring Framework release that TuxCare onboarded, predating all TuxCare work on this version. The target contains all three fix components: (1) C...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:0ca1df27-9a24-59c6-adc9-6c9cf7384009", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. CVE-2020-5398 (Reflected File Download attack via unescaped quotes in Content-Disposition header) is NOT present in spring-framework 6.1.21-tuxcare.16. The upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) was already included in the upstream release that TuxCare onboarded. The fix escapes double-quote and backslash characters in filenames via the appendName() method (lines 615-629 of ContentDisposition.java), preventing header injection attacks. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:e7737d5b-7020-580e-962e-bd82343d2117", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. Spring Framework 6.1.21 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:14305d7a-4eaa-5073-b7ba-0fbe8cb2eb64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. CVE-2024-38816 path traversal vulnerability in Spring Framework RouterFunctions static resource serving. The target version 6.1.21 is NOT affected because the upstream vendor's security fix (commit d86bf8b) was already included in the upstream v6.1.21 release before TuxCare onboarded it. The fix adds comprehensive path validation including URL-decode-before-validate checks, path normalization, and traversal pattern detection to prevent attackers from accessing files outside configured resource directories.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:4efc4430-2f3f-591c-87b3-22c135428da7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. The target Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-38819. The path traversal vulnerability fix was already present in the upstream Spring Framework 6.1.21 release that TuxCare onboarded. Three fix commits (3bfbe30a78, fb7890d739, e78179b96e) authored by upstream maintainer rossen.stoyanchev@broadcom.com implement early URL-decoding with path traversal validation in all four affected classes (PathResourceLookupFunction for WebMvc.fn and WebFlux.fn, ResourceHttpRequestHandler, ResourceWebHandler). The defense decodes paths (including double-encoded inputs), detects \"../\" sequences, normalizes them via StringUtils.cleanPath(), and rejects any resulting paths containing \"../\". Multi-layered validation via isInvalidEncodedInputPath() provides recursive checking against encoding bypasses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:15ac0921-aabc-53cb-8a73-2cf7589ec3db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:584da857-18fb-5f3c-8c3d-5181f204c959", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:ce185c27-f118-59d8-ab16-a19a6f2d7f30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:4d58c91c-7fd1-5841-9332-33a03b503f23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:2c80851b-0ab0-5614-8265-d4ea9236fb7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:bd9cc53f-40fb-5694-8630-74e9aac430a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:355170a4-54f7-5836-985e-1bdc14ccbcb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:3df2fff9-6dce-5886-8425-ab7c7c42578c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:9424cc52-b171-5a87-9457-d1987db703cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:a1f24bbb-ba7c-5b55-a6b0-f02b2e0d131f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:6780832d-c5f5-51fd-9e5e-6b7c440c0696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:4f1fc686-51e8-5fc1-a46c-f75988bd0dae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2026-41847. The vulnerability (incorrect lambda parameter capture in Kotlin Router DSL filter functions causing modified ServerRequest to be silently discarded) was already fixed in the upstream Spring Framework release before TuxCare onboarded version 6.1.21. Two upstream commits fixed all three affected files: commit 07ba957...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:9cf8f2b2-6b89-5b98-b18f-4ffafcfd377b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:8dbdb1b7-8a76-573d-9f3a-ddd8f84ee7d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is not affected by CVE-2026-47883 because the vulnerable UrlHandlerFilter class does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0 (commit edb6bb717d, dated 2024-05-15) and was never backported to the 6.1.x branch. The target repository contains no code that constructs redirect Location headers from request URIs in the ma...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:32dd7b60-fea1-5270-9940-5e88174ee5ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-webflux. Spring Framework 6.1.21 is not affected by CVE-2026-47890. The vulnerability requires the SSE view fragment rendering feature, which was introduced in version 6.2.0 (August 2024). Version 6.1.21 predates this feature entirely. While 6.1.21 has standard SSE support via SseEmitter, it already contains proper newline escaping logic identical to the patch fix. The vulnerable code path (getFragmentContent method in ResponseBodyEmitterReturnValueHandler and fragment formatting in ViewResolutionResultHandler) does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:5bcc907f-8785-5cbd-a99c-a72bb185a1cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:e75d39bd-0d27-554e-83af-6b8ffd141eb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:7b28d5ae-8a51-5903-bdbf-24fefb403b5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.21-tuxcare.15" } ] }