{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aa930f0d-e172-565a-91c7-4b6ef71129ba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8", "version": "6.1.4-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:7a3066e5-16ad-5fe6-acdd-a2fc3c82b560", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2009-1190. The vulnerability required Java object deserialization from untrusted remote sources to trigger catastrophic backtracking in JDK <1.6's Pattern.compile. Spring Framework 6.1.4 does not expose Java object deserialization via HTTP endpoints (uses JSON/XML/Protobuf instead), has no RMI or remoting features (removed in Spring 5.3+), and only ...", "justification": "code_not_reachable" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a09b0b79-6ea2-539a-b3b8-6bf56e8d6a29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:63448e8b-9506-5e17-aabf-434a014403c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:43935b8d-4a6c-563a-8675-cf88fa0854ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c1a2b387-d3bb-54df-a6b9-b5c64acad8a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:e9e1f697-cfad-5a6b-9a50-ac9aaa8b4fb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:41d6a90f-2eca-5b7d-93fc-a26c8cb6fd0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:b2735b40-8a17-56a9-8aa1-b1808dc971ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:8ebce848-945c-5dab-9503-fb1d2245ca94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:0fbcd115-e549-52b1-9db5-48b02e92b4d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:8fb7c092-e5f8-54c4-ae54-381422d0e632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:0141742f-c397-5397-abf3-eb66f29d4ae8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:04d9a683-f963-5f4c-9ff5-0bbe29837754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c6d6cab1-9b51-502e-988b-ba8bfece3003", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:48b6f421-835f-5284-bc63-818fa7845b50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:05a0ab78-c026-57e9-84d1-87ef8080f16f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c494556f-d32d-5ffb-90dd-c454e31e57f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:621a3087-ec9b-5b14-b5fd-332a294a8518", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4af0fb55-32e2-53bc-8068-86741e588db1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c030b7a7-46bf-5f5a-9ab7-819d01012e00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:5f00c694-b6c0-51f0-b0e9-e760d9f9f74c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:76a45998-40f9-57c0-8c37-9273a677ff13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.1.4-tuxcare.8" } ] }