{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d5c1c80-ac39-53a8-a022-0098645cd3d9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6", "version": "6.1.4-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:6b7179af-f218-585a-9f90-e6231821578e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2009-1190. The vulnerability required Java object deserialization from untrusted remote sources to trigger catastrophic backtracking in JDK <1.6's Pattern.compile. Spring Framework 6.1.4 does not expose Java object deserialization via HTTP endpoints (uses JSON/XML/Protobuf instead), has no RMI or remoting features (removed in Spring 5.3+), and only ...", "justification": "code_not_reachable" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:d55fc1f8-c43a-592f-ba63-e16eb4df4e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ce3119f0-d8aa-50da-bc11-9e9bc9a0f8c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:271b3041-e7f3-57b1-8b44-5fe8695bf12e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1527796a-3b7f-52ee-b128-1245ffb6f716", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5f134885-0d47-51c8-854e-420d3be19683", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ced4347e-7986-5d40-b958-9181af92083e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e239c4ef-90f9-5c3d-b454-988679659685", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:7dc897fc-7251-54d5-8d87-848835b04403", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:b4e57250-fee2-5df1-aa91-135caef73b27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:89f54141-3c04-52db-804a-793fe2e5f42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:433502f7-8afa-5e64-8c7d-82bcad74c966", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:40430937-cc27-5d21-9815-3adcf9b62ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e964caea-b511-5410-a717-0c559f0d66cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e5176128-d4de-5231-927e-9ae3b010a1df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:954e32b9-7a8a-5606-8b05-b19b1264f870", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:66a93b98-d6e0-56f1-ad85-101b4188c428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:138bf96d-c1b9-51f1-9d7e-b791e7da3ed3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:0f02f189-c5f1-5fea-bb57-4d3bb80297eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:cb193ec2-e7fa-5120-b8ba-89fb3095912c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:0460b00b-eb09-5ea2-a694-c4b6db5579d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:7004b064-c738-56ed-a64f-dbc8af6734c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.6" } ] }