{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9c65f742-5fb3-5032-be76-a584a8e9ba18", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bcc5d9b3-fa44-5d03-b74c-15ffe1492ca5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2009-1190. While the code pattern (serializable JdkRegexpMethodPointcut calling Pattern.compile without validation) exists in the codebase, the underlying JDK vulnerability (algorithmic complexity in Pattern.compile) was fixed by Oracle/Sun in JDK 1.6. Spring Framework 6.0.23 requires JDK 17 as its minimum runtime, making it impossible to deploy on...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:31839aef-bc4c-5604-a963-617b96308ab1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ceaccc77-8789-5d9f-a720-8050738f0e0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:55a87218-303e-57be-9de9-3e6a38a9d7fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ecac483f-813e-514a-ade6-df8f93727280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ecd307f6-5c79-5331-afec-1b681b10c664", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d94e322c-66c9-5f2f-849a-282ff690d91d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cd1c2f6d-d39c-5d56-8f13-1c6b0b8e8482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8adf92d4-16a4-5f1d-8794-e1a5366a6603", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9143456c-9bf9-55f6-96f9-bac44c2c2ba5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:33423241-1e1b-58be-a969-60f6e3e948b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c5458a40-2100-515e-9618-e5844917a6e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d3d18383-403a-54a1-a001-7d0059a7f1d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:29029c8f-52dd-5e88-a364-837a0f5c3a96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:857dceec-64a0-5884-b95b-f1a9ef175e7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:58098244-042e-5acd-9d89-52eed00fbee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ebe7361a-70e8-59a9-a00e-440489f8446a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:57335c19-42de-5e32-83ed-c63bb15a8a00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9cbd4dad-b487-5abb-af6c-d2f72b0d701a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e6c1fc0a-4e15-58b3-a906-8632be9cede3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1082acd6-ebd0-5361-954c-3a97c130e84b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e122bb6d-71d6-5123-bd77-d75b23424c88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.11" } ] }