{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d39cfd86-be3a-521a-99d0-9cd02a2782e6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1", "version": "6.2.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:cad39fcb-0ae3-5a2b-a146-af0425c115fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3a454c3a-6abd-5395-856d-e308351219be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:09376364-3ee5-5097-9ea3-ac19e251b3b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:6b36779d-4054-58d9-bf89-4b6243584e6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7db0099e-4760-5b10-9b0a-076a1c27a940", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.2.3 is NOT affected by CVE-2013-6430. The vulnerability was fixed in upstream Spring Framework 3.2.2 (February 2013) by adding proper escaping for angle brackets (<, >) and Unicode line/paragraph separators (U+2028, U+2029) in JavaScriptUtils.javaScriptEscape(). Version 6.2.3 was released years after the fix and includes it by default. The fix was authored by Rossen Stoyanche...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e77b71e1-6b41-53ed-addb-767672bb3a25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:31d456a4-98fc-57ad-b12c-56d223dac82a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ef464458-6823-5697-b54d-c9b36bc1501c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations leading to memory exhaustion DoS. The target (Spring Framework 6.2.3-tuxcare.3) contains the upstream fix (commit d79ec68db4 by Rossen Stoyanchev, June 30 2015) that disables DTD processing by default via supportDtd=false and the disallow-doctype-decl SAX feat...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:5cdf3d53-a8f5-5b1c-8715-787d9a985577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d84aef6a-25f3-5a73-bfe0-25ff5db5028a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:59a114a3-959e-5bc1-bc3a-dfd012690029", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8f1c8c8b-7de0-55bc-9ceb-8fa8621c5b4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:21864fb7-097a-5b51-af79-98e561901eb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:25d701ef-b0d6-56fe-8084-7e6b1656d132", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1ba77440-6333-5066-a398-9d7dc1f62f57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ac4cd725-2c02-59d5-bd74-04096c359bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:96a01bd4-5d18-53a4-840d-ed65bd9b9511", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4e2974d1-4db1-5832-a861-b680196a662c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:fa665c57-b34c-5468-ba93-d7138e2d0414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:54af08fc-b214-580a-9cc1-d38eed06e51c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:37bbbd4f-7d13-5a1a-bd11-534076c4c305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:171ba74a-21c4-52f8-b0b4-3f85b8dd5bca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b418564a-40e0-57a6-bff9-66690ccb9198", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:499e47a8-0255-5da9-9c88-7c06ecc82bd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ae768117-63b0-5db4-9be8-512e57f80b0a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:578caef0-d54c-55a9-8997-6c557f6c05a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ad309d7c-b11d-5862-a523-b5b2f644a8a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:57d98a70-5c6a-5804-b770-066eb6eec1ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:227b7daf-6e9f-5696-b5be-ad11f582be44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:130145fc-b7ad-5054-9cb1-901ed9eef686", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4472affa-fbe7-5d32-bcdf-52badbd11353", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.3. The vulnerability (regex-based ETag parsing causing DoS via catastrophic backtracking) was fixed in the upstream release before TuxCare onboarded version 6.2.3. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 by rossen.stoyanchev@broadcom.com replaced the vulnerable regex pattern with an efficient O(n) state-machine parser. The ta...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:bd3cd154-f345-53ce-9838-a2f42d9e2952", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:60936bcc-052b-5966-8631-e5aed3cb69e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0aa82921-a557-5dc1-b853-e7d456e69b1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1dbb3929-2635-58b6-a8cc-a213093b3ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e3fa986b-1c01-5931-bae8-3cc736ad979d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:88f13e9d-d902-588e-9078-95203bfd97ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:89703f80-e0cc-51df-8757-65b80bf4d4fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:717165d7-7fbc-5ae4-a00d-2974008217bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:45d1250e-1b4e-573c-93ad-2b93f855b72c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:465f5352-d31c-5812-9094-ec8e510e367e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ec97d9f0-957c-53e9-946e-3e4c60fb3238", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9bb0d889-21ad-5f33-8fc8-1ccb2099351d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9022b6be-da99-5df2-a940-d46f10da3b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e6f4bf79-db45-55e8-bbaf-d4b16cb9f9fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:af4d0af3-3a92-5ae9-85f4-85a493e72155", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:cb78f184-7885-5909-b651-59824ab30450", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:45b4e064-21d9-5903-b50c-e973c4e9b9b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:331ca072-304a-5428-94d6-181a2c6558aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webflux. not_affected \u2014 The target is not affected by CVE-2026-41847. The vulnerability (a variable scoping bug in Kotlin Router DSL filters where security modifications to ServerRequest were discarded) was fixed in upstream Spring Framework commit 07ba95739b, authored by shindong.lee@riiid.co. This fix was already present in the upstream Spring Framework 6.2.3 release that TuxCare onboarded, before any TuxCare modifi...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:96deca61-5f4e-5f80-8008-58e428cef42c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:18a759fa-ce63-57c0-b792-9f186f7c9a61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9d5fbc58-a267-5dc2-acf5-86cc7ed208fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:55b0c3fa-bb24-52fd-83f7-d51670ce7e9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3385c68b-13b9-51db-9161-f9f8b2cdf0d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:84e41a4b-5eb8-5af3-a596-cb1fcda0678e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1ebbda8e-a490-5661-8b66-39a21b1cd3e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7931ac84-5295-5bef-b90c-416387b7df7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:5eca91db-d7f3-53a3-bb14-acf54e22e39f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c2cdd7c6-767a-53db-b445-dc8c73c08ae8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:6d09bca5-5606-5f75-be6f-e8287871ca4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a32edc28-0203-5fa8-b04a-c3660c84733f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:348a7ffe-eeaf-5108-9d4d-1e5f7c2f3a54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.1" } ] }