{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:151f5578-c577-54f3-a657-06c85c9a3b4b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-data-cassandra-reactive", "version": "2.7.18-tuxcare.21", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a3523453-5eee-5733-878c-962b3b33b7aa", "id": "CVE-2023-38286", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-38286 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:876d800b-2286-5c8f-ac51-2b1822a38cc5", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:3b431418-b2f0-5f23-8710-069f9ab12f96", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:df45ffa4-2636-59ca-8d35-c505f61a2e6e", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:063de241-01a1-5262-adec-de1e9e387193", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:194f1376-1a6f-5f8d-b99a-574d97eae4e3", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:4de09039-f02d-523a-bf8f-064dafff3917", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:5ffd982c-ea27-548e-93ac-54b1704ae57d", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:5bfc2c42-207a-564b-a466-74d0e277ac1c", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:4bf8f4f7-4549-574a-865a-15ec851d5f70", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive. not_affected \u2014 Spring Boot 2.7.18 is NOT AFFECTED by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature (spring.mail.ssl.*) introduced in Spring Boot 3.4+/3.5+/4.0+, which does not exist in version 2.7.18. The target version uses a simpler architecture where all SSL configuration is manual via spring.mail.properties.*, and the auto-configuration does not handle SSL at all." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }, { "bom-ref": "urn:uuid:be588559-616e-5cc7-9ea7-55492c3b07b0", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-starter-data-cassandra-reactive." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-cassandra-reactive@2.7.18-tuxcare.21" } ] }