{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:182b54d9-c494-5cec-8a23-843a597d7092", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1", "version": "5.1.18.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.18.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:82810a49-3081-5adc-80a2-95f526dbb332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7eaba35f-25f8-5058-96c7-d35a18643e98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b0b06781-085a-5b91-8d8c-7280cc149f2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e939bca-41d6-558a-abe4-57087e7d1a73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:14b6d5fc-edb2-593e-a3e9-6f15c5da1807", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE already contains the fix for CVE-2013-6430. The vulnerable pattern is not present because the upstream vendor (VMware) applied the fix in commit f5c9fe69a444607af667911bd4c5074b5b073e7b by Rossen Stoyanchev (rstoyanchev@vmware.com), which was included in the upstream release that TuxCare onboarded. The JavaScriptUtils.javaScriptEscape method properly e...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4de0a3d7-d319-58f7-b89e-939f042a71c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d51762f4-b1f3-5947-9d49-9fa706ce7302", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75715586-4acf-56ac-b509-75bd8a6f1150", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 5.1.18.RELEASE. The fix for this vulnerability was included in the upstream Spring Framework release that TuxCare onboarded. All XML parsing classes (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter) have DTD processing disabled by default (supportDtd=false) and set the disallow-doctype-decl pa...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0bd30e0-d6aa-590a-8622-f5dd9a7d2f8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2afde4f7-2e7a-52fc-bd93-bb9e42d6eb41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f11ca80a-e506-555f-a975-32e561edbab9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7f1a68d-5041-5b49-9437-821a9a9ef471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8edb43fa-5aa3-5ec0-bb26-103b5367a7fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:552947db-f5fc-5e73-95ad-226b7a1504ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7ea235b9-deb7-59c6-acbb-552cf32198f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT vulnerable to CVE-2018-1257 (ReDoS in STOMP WebSocket selector header). The fix was committed upstream in April 2018 (ff2228fdaf) before any 5.1.x version was released. The vulnerable code pattern never existed in the 5.1.x line. The fix allows administrators to disable selector header processing by setting the selector header name to null, preventing mali...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f923bfbf-61b2-5cd0-b892-5a517141d03a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:28734408-e41b-55ec-a991-4554671120df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:67fbad77-3dc8-5f00-af58-44dad8b113a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f8c7219d-4584-5fe7-b5b5-6a627c317fe7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9cc2784f-32cf-51c2-9aa4-29c4f03ef7cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:227e015a-536a-5bb8-bfd9-24823d2306f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:049f960d-bcb3-5eb5-924c-e11385e9f82d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:35187ab0-b255-53b2-a79c-483e16189109", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d79af50-86a7-5c4a-b82e-cca2e4cfe80e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ff3ebb99-caeb-5515-8326-dedcd2c4bae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ae54367-e590-5e25-b2d0-96c8b45f9e27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9192a55b-42a0-5036-bfd4-bb13b30c1cbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4913eaed-f951-529a-8f9a-33f158bcfab3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da243651-584a-5826-b89a-1e50893cb1ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fdd8c9f4-f3f2-53e5-a190-817f96080b9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2c3c7f1a-335f-5562-9123-0cb25ca74f2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b368e37c-850b-5118-b452-27aaa553efaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:51874cfb-8794-51d0-810d-dce8e2e64b08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ffe59c84-7e73-5958-896c-77dd35437bd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Version 5.1.18.RELEASE is not affected by CVE-2024-38820. This CVE concerns locale-dependent behavior in toLowerCase() calls that were introduced by the CVE-2022-22968 fix. The target version never received the CVE-2022-22968 fix and therefore does not contain any toLowerCase() operations in its DataBinder disallowed field matching logic. The vulnerable code pattern is completely absent from th...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4d720b54-9479-5bfd-9c4a-f682a62691b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT affected by CVE-2025-41234. The vulnerability exists only in version 6.x where a new MIME-style encoding architecture was introduced. In 6.x, when using non-ASCII charsets, the code outputs BOTH filename= (with Quoted-Printable encoding) AND filename*= parameters. The vulnerable Quoted-Printable encoding uses a PRINTABLE BitSet that, before the patch, did ...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:597236a2-bfd2-55ad-9e62-017e35dfab46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:48ecd9d7-3fb7-5a51-a2f3-793d6b510d5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e59bbe9f-3a8c-52a6-9b85-13e0cb480559", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:68e1fe02-938b-539b-b83f-d3c49bc141d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2bd20dc5-a5d9-5c58-9b07-9c782935a67d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b4d913ad-8243-5961-9854-ef416deb42c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8f9ec6fb-14d7-55fc-a747-07832bd8d59b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e59b0070-c911-5e50-84e3-1aac48532586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8e97ab02-0c5e-5b6d-a656-0cb26faa2fb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:727147d6-0399-55d2-b75e-754d25de7410", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:398540ff-cccb-58fa-97ab-f906707c3223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4234b9cf-57b0-5fc0-8755-6481d631a5b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:193de2f3-f841-55c1-a67d-2a6fb94790d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:17d58c46-ea55-5d07-9262-f46a2bf82a0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-41847. The vulnerability is specific to the Kotlin Router DSL filter function, which does not exist in this version. The filter function was introduced in Spring Framework 5.2.0.RELEASE (released after 5.1.18), making the vulnerable code pattern impossible to trigger in 5.1.x versions. While the target has spring-webflux and the Kotlin...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:54685e45-2f48-5ee4-a592-1dc6be56cf9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:483fe7bb-fa05-5e00-bd51-0b9e3d1c191e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b6cb625-8bf3-5533-93cb-1f8b522135fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:39f40eaa-efee-5960-a4ca-a2340f9d38fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version. UrlHandlerFilter was introduced to Spring Framework in May 2024, almost 4 years after version 5.1.18.RELEASE was released in September 2020. No alternative mechanism exists in version 5.1.18 that exhibits the same vulnerability pattern (taking request URIs...", "justification": "code_not_present" } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d03544b8-89f7-5afc-8cea-2f95c6f7b79b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47885. The vulnerable component `PartEventHttpMessageReader` does not exist in this version. The `PartEvent` API and `PartEventHttpMessageReader` class were introduced in Spring Framework 6.0.0-M4 (February 2022), well after the 5.1.18.RELEASE version was released. This version uses `SynchronossPartHttpMessageReader` with a different a...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:106785c8-d73c-549a-b0a3-0f7c739b242a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE does not contain the vulnerable JettyCoreServerHttpResponse class, which was introduced in Spring Framework 6.2+ (January 2024) for Jetty 12 Core support. The CVE specifically affects \"a WebFlux application running on the Jetty 12 Core reactive adapter.\" The target uses Jetty 9.4.31 with a servlet-based adapter (JettyServerHttpResponse extending Servle...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8b9f6ce3-87e1-5e0c-ac4d-b600ed3d0487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47890. The vulnerability requires the view fragments rendering feature with SSE, which was introduced in Spring Framework 6.2+. Spring 5.1.18 does not contain the Fragment class, fragment rendering infrastructure, or the vulnerable code patterns described in the patches. While 5.1.18 does support basic SSE through SseEmitter, it cannot render view fragments as SSE events, making the vulnerability inapplicable to this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:79a8ad42-c396-5419-ba6f-ca2e786b91b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:101a6414-8bc9-50c6-aef5-6f649135942b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:68614104-8169-5da8-a8de-5415747f51de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c68ee905-33b4-576d-8034-c9dbcdb97992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:daa0011a-b9a7-52a1-9ecb-3bfd7aae13de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:37a30778-4723-503e-8ee6-1b620575de69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.18.RELEASE-tuxcare.1" } ] }