{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:21c60818-98e1-5333-b9e1-1e7b7081aa40", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7", "version": "6.1.4-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6e4a346b-7782-5641-ac77-698055b8eaa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:64ca3b78-fca4-51e7-bf10-cadf590e0e86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6997e64e-c25e-56f8-a344-727d0b5dcbd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:cdda6d50-7823-5e47-abe4-a236ed236fc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:4bacf75a-e3e0-5a41-8e12-fa6f8ebde70e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:90a27748-9034-5337-b8b4-392ea0c3348f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f320cc22-14ab-5775-95b7-b5599cff77bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f7e90c68-5be1-5f42-a85c-20b77594f7c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:00c18dd7-afe4-5106-bdb8-e305525e0be1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:7952f450-cc22-5c50-971e-a41d6db6a313", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:3ca7087d-cecd-5c1d-a243-4beadd12dafc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:57574cb8-e56d-53f1-ab05-c0115e3b5c6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:930a5b81-4ccd-5809-bc67-c108cec4552e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:bbb282a2-5d68-5b89-bce5-22e9ef63b5f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:e915bb71-71a8-5e1f-9011-496249728680", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:a99984ea-0bdd-5327-952a-92e43c43eb5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:427b8d39-f0bb-5271-bb8c-d066c3a21d49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:93eeb930-9f87-5b5d-b9dd-69a24251c0e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:a0d3e11e-c964-5bc6-b185-9f5913596919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:441ce362-70f2-58d5-82ca-3ff12440fa08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:53098b5c-9e5a-55b8-a538-9df83cffc6b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:714ccd21-c2e2-56f9-9d13-c9faa2d15ded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.7" } ] }