{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:95b50fba-eef2-5402-8dbd-82c52714199b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-r2dbc", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d4235a76-28c9-5009-972a-fabbf9b70731", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f13dc51a-3b60-585f-99d2-ed44716edfb0", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1ca00ae4-f592-53fa-a86b-2c97bbd38547", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:445e9705-808e-5012-b892-700e2e9111d8", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:10a4e574-42dd-57a8-80ce-9a0d787fd348", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9299606e-ed3f-5dce-89c8-852b92963130", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a504c2a0-7abc-5bee-beca-e90d31393bb5", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ca336827-5b1e-53c3-aa9c-bfe8c63c81a6", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ee3bb8fa-ba6f-5901-9143-b93a22599740", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:dc87e715-a962-5930-adc9-1d575c5d27aa", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ce6998c8-0434-58e6-9769-4eaab8c81d17", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0327424f-f1c7-5a84-8abf-0aea831cb855", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c73c12e5-165a-58fa-960a-ac9bf47fe081", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c0ec65ae-3cb6-5f4b-b43a-fa7bb294bade", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c601c92a-9695-5eac-9296-3bdbbfca44ef", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d5e6d084-e9d0-5e61-964f-56ed19dbba2d", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:dede8e86-75a4-5f5d-a27b-1d66b3760767", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e659b7be-443b-51e6-a8f8-f62a4b31145e", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9b44815d-21f6-5d98-b76c-445ee93d3dbe", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2c776b71-b182-58df-a375-e94a40ee542f", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1fc5a2e1-f7f0-5a7f-b72c-a5ec75c723ee", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:26433e42-e33c-5c47-8d3d-4fee796d7c69", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:05e3e883-5364-569a-99d7-88c33c5bcbaf", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a742e860-cfe7-5d53-be9a-4334b1116767", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3c513c22-2b02-516a-9370-67f8712d6158", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a90cfcb3-6cc5-5656-b322-73546acb84c9", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e160dda1-482e-5c81-b584-c71aad6801ae", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:10e65bed-7b17-53a8-8dc5-7fa97750622f", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2b189fbd-5420-5230-a532-34a41af1a961", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0fc9b0c5-7a63-5320-8c4b-074228f70788", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:70803ba0-d5d3-50f8-847c-297ecb10fb4e", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fb5e91d3-d466-5eb7-bb18-425928412726", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:29f35a40-f029-5836-a7ff-36b2e6086977", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:130ab67b-bbf4-5d94-b51a-cdb1afaed87f", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2e016385-9a38-53c9-bee7-0b600715ca35", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:46656720-2e2b-5580-9469-b3296f9506fb", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c333fe23-c8b4-593c-b6e5-e041a5f35a3f", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2a5dd843-4e12-5a03-bfe1-7a728ac10edd", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5779ab54-f2fa-599d-a892-a6318d237796", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:546cf9a5-5da7-5b58-b026-06715f79d40c", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ca7b0767-be82-5a3b-88e4-ee5d8e0a680e", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0faa734c-7e21-5385-ac2f-e165eb0907a7", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:653839ff-5668-587d-93c2-596185ea1736", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:47c17a6e-dc20-5334-88e5-457293c47b73", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9e15645d-a09b-5b76-8d0d-40900b0a404f", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2e9127da-ff37-5f9b-a57c-fc0eec11e9fa", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2cae6285-286a-522e-998b-ac08b33a3f27", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.37-tuxcare.11" } ] }