{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3abedb1b-9789-584d-a96b-397c0cb1343b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5", "version": "6.0.12-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:dcda1001-9530-505b-8fad-23a8d7f763ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3133baac-3275-5dbf-a6aa-d07832ef675b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:18ed33ac-48e1-5ab2-a90c-55becdf58712", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:268084f7-3348-5f11-b16c-8fde49ac0481", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:9431defa-d328-5c47-b141-b949a52d1f11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:786f8526-a502-5cc7-99a9-78a09ebe8815", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:72ff28a0-553f-593b-8e06-2d37008e5ed7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:abe4aedb-e06b-56b4-81af-25d461bcb88e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:5e54aabc-49a1-5abd-933b-28da66cea7d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1569c1ee-eba3-58f5-9e0b-c6aa68ed6a99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:4ce1c88a-3ef0-5111-9189-c4d7c736e61b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b6a6e224-27ec-54df-949b-c664b8d75af3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:abe50419-5d93-5a9a-af76-a8eb8a38d3ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:42c20c01-7dbf-5270-bebb-c53578d52686", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1e7c30d9-dec8-53af-b4b3-ef3dc28ad398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:167f7954-0978-54c8-80ae-0e9fab61a883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a66bd156-aaff-520b-aaa7-a7162ea3059a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ce7f3096-7be0-5a91-940c-c3474475047d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:aa13b4b4-7ce4-5657-8755-ff53ca5e1a64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:81f74bb2-697c-5f0c-aa50-6000f3905691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:e08831e4-1d41-543b-abc7-2fe26398ad30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c2f304e9-6226-5e2a-b1f2-f199fc06404e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.5" } ] }