{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a139865-6664-57be-822d-86c044bac33d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-webflux", "version": "5.3.37-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b1830c57-fb18-5449-8c4c-a637aa612016", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a841c81e-e5dd-597d-8bbf-277a7d374684", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b48dba53-0204-527f-bb90-297afa4a01f7", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:52265600-7fdc-58b4-bc46-8446b60faecc", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:13818fd4-6659-5651-81bc-d35e09a8d609", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8a487027-e60f-57fd-9d43-687642024c2c", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:37046308-41ca-54c8-8b08-01b4a237d8bc", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4b3c7326-a6ed-503b-a72f-88aaf8fec457", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:42904a62-2ba1-5714-aded-dcc4b5a5cb0a", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f138c5ef-50bb-5854-a445-a1e8c80da3f8", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:93183a6f-84da-5485-8eaa-ba1040b30e3e", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f8c3e1cc-d402-5e63-b009-5ee663955f68", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:10be800a-23da-54b3-ab2a-f1c2ab967337", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9cbb146e-8f05-56ce-8689-56b16932d8a2", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:56cc3151-fe87-5d8a-aef6-ace2adb66bfb", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ba9aa4a8-186d-5ea2-9d5a-8b357f952ea8", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d1fd0814-ef47-5875-ab8a-27a5dd0bba07", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:916251fc-3cb1-53c9-ba86-9e8c9ec13beb", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:214fa51e-5458-57ae-ba8f-2f68171e7325", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-webflux. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d55755a5-4729-58b7-9006-77b2f9c21d19", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:476d71a6-be16-54c5-a7fd-959d3357ad09", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f1872744-7bc4-5951-a23f-80f9f7b2df2c", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6fee7c24-a894-5d07-8656-b2eb21dcf024", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bd788b77-1d8b-57d2-83bc-f6af35862513", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b98e78e8-00c4-5a73-8c80-61211f1c5025", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:887099b2-d44e-5c2b-ac55-75c95ab5f0f0", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d2bd45d3-63b4-50e2-a774-d4529dfb8e52", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bc93635b-579e-59a0-9153-2f296f43dafe", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-webflux. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a7d1c26b-7a7b-52ea-92af-7e038247d779", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ca27f12a-6c7e-500a-b233-7a9851aad310", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:be71d346-c0a2-5dcd-8ea9-158445b76858", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:babfe2fa-efb7-58d2-b2f8-c60c405cd517", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5c19b951-145b-5ab4-b873-1124f584dedd", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0174fadb-1551-58b4-9f96-fcd10ae1ccde", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2dbb78ef-494d-51a4-b640-474a3a528610", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:48e2b231-c012-51b0-81eb-b0fe3d3ce084", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ba92a321-0313-5cd5-ace2-53484960f63b", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:89a642c6-2a5d-5c81-bbb9-af57f5f7fde1", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6320ece2-d868-5489-8dd6-25ce7dc3d79f", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d3728f76-dff5-5c32-b30c-ffb93535f2b1", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e18f40af-6c10-5188-8313-580e6f7eb295", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c271fd43-fe5d-5f53-89b2-21ba404c341f", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:92b1d4e6-044c-54a2-9ecf-880175f0b0c0", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4050c5ce-6f07-5958-b677-6dbeb8fab9c6", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c16a26ae-94c4-527c-86d2-49b955ee1045", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:34c7c125-b382-5c4b-afbf-3cabad3dfbe0", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:64b0dd85-700c-5f4d-a6c7-5e9651b3ea97", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.10 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.10" } ] }