{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:721116d9-8e69-5354-ba1d-63db59587020", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2", "version": "6.2.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.5", "type": "library", "group": "org.springframework", "version": "6.2.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:acc61b2e-1ce1-5d7b-be93-7ebf43dd8240", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 affects Spring Framework versions 5.2.x prior to 5.2.3, vulnerable to CSRF attacks through CORS preflight requests lacking proper Origin header validation. The target repository at version 6.2.5-tuxcare.4 contains the complete upstream fix (commit bc7d010485) that shipped in upstream release 6.2.5. All fix components verified: CorsUtils.java files check Origin header presence (ser...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:310cbfef-582b-5765-afea-e82e5d651da5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-webflux. CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename) is NOT present in Spring Framework 6.2.5-tuxcare.4. The vulnerability was fixed in the upstream Spring Framework release (commit 41f40c6c, Dec 2019) BEFORE TuxCare onboarded version 6.2.5. The target contains comprehensive quote-escaping defenses on all code paths: ASCII filenames use appendName() which escapes quotes with backslashes (ContentDisposition.java:624-626), and non-ASCII filenames use encodeQuotedPrintableFilename() which hex-encodes quotes (PRINTABLE.set(34, false) at line 71). Both defenses prevent attacker-controlled quote characters from breaking out of the quoted-string parameter value in the Content-Disposition header.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2f6fec23-2528-5ea7-8e66-4b2fdb825081", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 6.2.5 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:fafb3ab9-773d-5de7-aa5b-fbbe603119ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-webflux. The target Spring Framework 6.2.5-tuxcare.4 is NOT AFFECTED by CVE-2024-38816. The vulnerability fix (commit d86bf8b2) was authored by the upstream vendor (Rossen Stoyanchev at Broadcom) and was already included in the upstream Spring Framework 6.2.5 release before TuxCare onboarded it (first TuxCare commit a47acaade5). The vulnerable code pattern does not exist in the target because the upstream vendor removed it prior to the 6.2.5 release. Both WebMVC and WebFlux PathResourceLookupFunction classes use ResourceHandlerUtils utility methods that implement all the security validations from the CVE fix: path normalization, URL-encoded path validation, and traversal pattern detection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c725a9a6-dd9b-5b5b-a771-6604465e152a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d13cdc2a-b55a-57f2-ba9d-303d0e414ca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:ddedf85f-f97c-5b2c-a842-e3745e9c2f7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:372f19c2-2c29-5064-88d0-eff7e92c2748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:e2c9d747-6212-5cc4-be88-f45efa60d79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:097fe275-cc1f-5a7e-8cf1-5dd90cf5d437", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9d7c26a9-1a35-5e53-a9bb-84a5c9f58d16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 6.2.5-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 6.2.5-tuxcare.4." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:18730c96-8b19-5f9d-a5df-6d89e46b6166", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 6.2.5-tuxcare.2 of org.springframework:spring-webflux, and is fixed in 6.2.5-tuxcare.5." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:014966da-ac41-5e9f-aeba-5e7a76d721db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:67dca55c-44a2-5722-994b-2fab0c5a138d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:10123279-58e8-5e0c-bb3d-7a4a2848cc52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2bb3ea09-d32e-5ca6-aca3-181f52eacd19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:0e3c3b8d-6f71-583b-bb7d-3b6726025f90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.2.5 is not affected by CVE-2026-41847. The vulnerability (incorrect parameter passing in Kotlin Router DSL filter functions causing security modifications to be silently discarded) was fixed in upstream commit 07ba95739b (April 2021) which is present in the upstream Spring Framework 6.2.5 release that TuxCare onboarded. All affected filter function implementations ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:8f158d3e-4fb6-557a-8792-125054d402f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:1f7c0876-bee2-521d-be3f-86303ef688b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d62aef46-d08c-58f6-91b7-31009ea0ba8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:18612c7a-078e-5280-894a-38cf3bd8c54c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:45327736-86e7-54a4-a489-692acff7cf64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ], "bom-ref": "urn:uuid:5ca547f9-c0bc-5fb7-accd-9e502d123aa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.5-tuxcare.2" } ] }