{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6cf5e710-4608-54c3-a6e2-da03a6ecc5f0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3", "version": "6.2.19-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.19", "type": "library", "group": "org.springframework", "version": "6.2.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:2a9b21f6-b76e-538b-9b44-02989edd14f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.2.19 is NOT affected by CVE-2020-5397. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) was already present in the upstream 6.2.19 release that TuxCare onboarded. The fix adds Origin header validation to CorsUtils.isPreFlightRequest() and ensures all preflight requests are processed through CORS handling, preventing non-CORS O...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:93e31ada-2ed7-5522-b652-724022b9efe7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. CVE-2020-5398 is not present in Spring Framework 6.2.19. The vulnerability was fixed by upstream Spring Framework in commit 41f40c6c22 (December 2019) which added quote and backslash escaping to filenames in Content-Disposition headers. This fix was already included in the upstream Spring Framework 6.2.19 release that TuxCare onboarded, so the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:38534fc7-3480-50bc-96ee-81fc55d92a8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 6.2.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:615b73df-c3d6-528d-8eb9-bdffa933e1c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 6.2.19 is NOT affected by CVE-2024-38816. The path traversal vulnerability in PathResourceLookupFunction was fixed by upstream Spring Framework developers before the 6.2.19 release. The target version uses a refactored architecture where PathResourceLookupFunction delegates all path validation to ResourceHandlerUtils, which contains comprehensive defenses against path traversal: normalizeInputPath() removes backslashes/duplicate slashes/control chars, shouldIgnoreInputPath() rejects paths with \"../\" patterns (including URL-encoded variants), and isResourceUnderLocation() validates that resolved resources remain within the configured directory. The fix commit (7d3a3d35ce by rossen.stoyanchev@broadcom.com) is an ancestor of the TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:e8ca6200-bb75-5853-9448-ba7fdd840f25", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. CVE-2024-38819 path traversal vulnerability is NOT present in Spring Framework 6.2.19-tuxcare.3. The upstream fix (commit 7d3a3d35 by rossen.stoyanchev@broadcom.com) was already included in the upstream 6.2.19 release that TuxCare onboarded. The fix adds double URL-decoding in ResourceHandlerUtils.isInvalidEncodedPath() to detect encoded traversal sequences like %2E%2E%2F or %252E%252E%252F before they can bypass validation. Both WebMvc.fn and WebFlux.fn functional frameworks use this shared validation logic via ResourceHandlerUtils.shouldIgnoreInputPath(), providing comprehensive protection against the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:89c9244a-c76b-5ca1-a055-fdcc90c2f956", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 The target repository (Spring Framework 6.2.19-tuxcare.3) is not vulnerable to CVE-2026-22735. The fix for SSE stream corruption was already included in the upstream Spring Framework 6.2.19 release that TuxCare onboarded. All three affected files (ServerSentEvent.java, SseEmitter.java, ServerSentEventHttpMessageWriter.java) contain the complete fix: validation that rejects newline characters in...", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:5a8b210a-a39e-590e-a55d-0670c45a8116", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 CVE-2026-22737 (path traversal in ScriptTemplateView) is NOT present in Spring Framework 6.2.19. The vulnerability allowed attackers to access files outside configured template directories via path traversal in template view names. The upstream fix (commits de6601fdac and 317a1f9909 by S\u00e9bastien Deleuze) was already included in the upstream Spring Framework 6.2.19 release, which TuxCare onboard...", "justification": "code_not_present" } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:5838bbdb-8229-5ecd-b99f-d39b645d976c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. already_fixed \u2014 CVE-2026-22740 has already been fixed in Spring Framework version 6.2.19. Both upstream patches (commits b338fdd99d and 474d520182) that add doOnDiscard handlers to prevent temp file leaks during multipart request cancellation are present in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:a3f97421-192f-5f69-8992-b2ddde7f4647", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. already_fixed \u2014 Target repository version 6.2.19 already contains the upstream fix (commit 46867fad81) that prevents cache collisions in CachingResourceResolver by including resource locations in cache key generation.", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:44766f7a-f043-56de-ad99-adcf9e52c835", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22745 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. already_fixed \u2014 CVE-2026-22745 has already been fixed in Spring Framework 6.2.19. The fix (commit 684b1e8a4b) adds a file.exists() check before file.canRead() in FileSystemResource.isReadable() to prevent expensive file system operations on non-existent files on Windows, which was causing DoS attacks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:407ca787-89e0-5e9e-8b43-935755875bc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:c091c824-6e11-5058-9e7a-c99962adce66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:0f98e931-6943-548a-ac0d-349fead2ac26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.2.19 is not affected by CVE-2026-41841 (cache collision vulnerability in CachingResourceResolver). The fix was included in the upstream Spring Framework 6.2.19 release, authored by Brian Clozel from the Spring team. Both CachingResourceResolver classes (spring-webmvc and spring-webflux) correctly implement the fix by including the resource locations list in cache key generati..." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:f87e6e7f-4baf-5e73-af39-8e16ad6adfff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:1fbcc22f-1650-5893-ae45-6441dd7e946d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:7d1c4fe9-c65f-5cda-ae3a-45a38361406d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41844 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:b867dbbb-4485-54fa-8f7c-9a513cd8c374", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.2.19-tuxcare.3 is NOT AFFECTED by CVE-2026-41847. The vulnerability (Kotlin Router DSL filter silently discarding modified ServerRequest) was fixed in the upstream Spring Framework release before TuxCare onboarded version 6.2.19. The fix (commit 07ba95739b from April 2021, closes gh-26838) is present in both CoRouterFunctionDsl.kt and RouterFunctionDsl.kt, where th...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:faafc4f7-90ee-59be-86b9-8844c51074a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webflux. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:49d585bd-2830-54ec-8bfd-65e30288f0db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:0c86abde-2eda-58b3-8bd1-74a96dc99e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:ffebef7c-91cc-5a32-9f1d-f1effcf223fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:e21c90ac-35de-5aed-b930-42f2b43bc950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:c9675204-30f3-5dce-bfef-94ce9ff319f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.19-tuxcare.3" } ] }