{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a8d6ed05-e424-545b-865a-97aba549ac58", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3", "version": "6.2.3-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:bfe2f7c6-2413-5193-bda1-56036a6b24ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:38e53458-45c0-5912-9c3e-4b3a43ed0af0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a1302d54-86a1-544f-b4f7-a2704d9b7416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:9c47109d-4514-56f6-aac2-ed4d783853f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f48c60bc-da6b-5887-bec8-cfe7120be393", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.2.3 is NOT affected by CVE-2013-6430. The vulnerability was fixed in upstream Spring Framework 3.2.2 (February 2013) by adding proper escaping for angle brackets (<, >) and Unicode line/paragraph separators (U+2028, U+2029) in JavaScriptUtils.javaScriptEscape(). Version 6.2.3 was released years after the fix and includes it by default. The fix was authored by Rossen Stoyanche...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:ee6f641d-937a-57d8-a937-e42cc1a0fb61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:10e257b9-046a-53ec-a415-6a85b46d17a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:c976cf18-f69b-5ed4-86fb-0e77081e71d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations leading to memory exhaustion DoS. The target (Spring Framework 6.2.3-tuxcare.3) contains the upstream fix (commit d79ec68db4 by Rossen Stoyanchev, June 30 2015) that disables DTD processing by default via supportDtd=false and the disallow-doctype-decl SAX feat...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:ab479499-f101-596e-8cae-f777d723c2ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:640b962f-2abb-55c0-8661-7de4b31550df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6ffc88c9-f27b-5738-9ccc-850cc213cfbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:48a9caa6-604c-5c5d-95ce-c5dad9bf702d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:41591db6-f50d-5e73-9489-66009a6ccd3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:096eb419-23bb-5cbf-9847-af9ac1ea973c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7d2438e2-fb42-5ed3-8db4-f7966e56036e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:31fcbb26-ef2f-5cc5-ab3e-cc4cf641d35a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b03f65cf-7189-5fec-bb41-be331fb1a1d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:8d3b08fc-792d-5224-9c8c-3052b3f3d061", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6c694d96-fc7d-509c-9189-169dafbc19dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:96e9dcb9-432f-583d-90c5-f34007b991c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:16aa1456-4d5d-5067-987c-2afa579b36cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7c449048-f922-5afb-9c67-6a54f4bdf219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:4755006f-bd4d-5e44-8ad9-52b624174627", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:27c9ae33-5c3f-5ed3-a6da-16912e5dfcce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:835f8c8b-ab13-50b7-91eb-4d09745c43cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3a3251f5-1ce6-5d9f-bdbf-b0ffb9e65776", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:5a48edcf-9348-56f4-a25f-c884ac1fe26d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:cab63ac3-f8e6-53b6-92e0-1a2c59adb114", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:9896f279-fd96-582f-b731-8cf364aa4e68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:030af701-2197-55c9-a453-8bb4942c7a60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:606121da-7d6d-5b55-9a77-a35df803513b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.3. The vulnerability (regex-based ETag parsing causing DoS via catastrophic backtracking) was fixed in the upstream release before TuxCare onboarded version 6.2.3. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 by rossen.stoyanchev@broadcom.com replaced the vulnerable regex pattern with an efficient O(n) state-machine parser. The ta...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:76b016d3-22d1-52cd-bece-e3f026a372f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:90c2a13c-50c9-51e6-9b4c-049bdc4059c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:869ecd8a-7b13-54d7-ba4a-c26e41df0743", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f3376e95-d503-5bee-a78a-75f18ee9c81f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:26765ad1-6448-5028-bee2-df7d78664f9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:288cbe11-2519-5f49-92d3-712a7d30a77d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:bc04f52b-2667-543e-a5bb-48151beed2ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:580d170d-c2e5-565f-aaa0-f4578fbb2dc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6f8064fd-6238-5f8b-94b0-87c0021056be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:454577d9-fe28-5f54-bbfa-6106ac48885c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:9d1b9bf1-6a3d-5b61-afe4-9e1a64851923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:20ca3e0e-f3ae-5f13-9b71-949f331b9b96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7ab5ad23-81a8-5959-8b2d-389043b92a89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:53e80a7a-fd46-5d5b-991a-a94101253687", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:402bfd1a-ddfd-5dde-8d35-e498dbc6bede", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f276abb2-cbd8-53ae-b892-07af66817c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:9f4a5c35-e550-5f92-8d75-6e846249f078", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:61ca2a3f-f0d7-5fac-97f8-1dff11333494", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 The target is not affected by CVE-2026-41847. The vulnerability (a variable scoping bug in Kotlin Router DSL filters where security modifications to ServerRequest were discarded) was fixed in upstream Spring Framework commit 07ba95739b, authored by shindong.lee@riiid.co. This fix was already present in the upstream Spring Framework 6.2.3 release that TuxCare onboarded, before any TuxCare modifi...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:14b42c11-d70b-59df-adac-36b5e8ee4bb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e606ea32-6e19-5ac5-9dad-578a061896fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:966af675-5800-510d-823d-70e53fed4802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:ebb00eb7-9330-5989-af40-ecd3cd221323", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:0d42ed92-4654-5320-846e-cc4c902cc074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f650d2cb-afb4-5cdc-b370-e3946ca93dc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:5607a465-30ac-5e42-a62b-10d7e25c2e84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:fa1d31af-f389-5f05-9ce4-9de5bae28ce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6ab970b5-ebb6-5622-aa54-e0e76a438c38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:30bfc9cf-4e26-59f0-936b-da7f857ad0c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:dcbbbb1e-fc45-5bee-9651-69dc3c9d229a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:06f6f32c-a807-5b86-a3d6-4d27f48fed2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:dd7dae56-d7cd-5594-a197-2931acfef4d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.2.3-tuxcare.3" } ] }