{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ea3cba37-0d9b-5486-80f6-e52359f250fe", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c7c9602c-005f-590e-a8c0-9b24d90204f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f96de2e4-9582-5059-8f51-47279fe4457c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a581cd74-de09-5c2b-97c1-3a867715c47d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:26d113c1-2fa1-5fb1-b3bb-34ac8d241054", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:95c4e9f8-a2c0-5ae3-995b-1a382ff6f13c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:bb8d1664-cba6-5821-953b-889218cfe1ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a227f670-d469-5f5e-accb-04366822ea91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:29896722-80fd-5405-9cf6-00b4ed046d33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b4f1ea87-1eb4-52d4-8524-5f145f4af071", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1aa34281-5f76-5fe4-9c97-15490943fdb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cab648cf-3ca6-5b10-9382-df4ab66a00ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2f65d408-bf09-5c75-bb7b-652ceb194f79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:67fb1bff-00a1-59d8-8454-29635480d87a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9d5acb2d-be73-5ddf-8bfe-2cb37070f29c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f6e8af16-8bab-5575-b5ea-564b0916d81e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7e51165e-c311-52c7-b404-583442a5871f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:849ea531-474b-5abf-a4d4-beb33a47c414", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:67eeae91-85b1-503c-a350-ec17f61fa446", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:14a96d3a-325c-5c1c-a2f1-67a37797870a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1b201a64-d2a0-54bc-95b0-6d053a5a9106", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1ec5a1e8-cf4d-5074-9a90-788c6d6fa9c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8fb7b3e3-f515-563b-af93-e5a5fa526466", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.23-tuxcare.12" } ] }