{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7ac15c49-6d9e-5e02-952a-bff9479a57ff", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-data-r2dbc", "version": "3.3.13-tuxcare.5", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5768ac07-2027-553e-9d71-6d8cd5d3fa8e", "id": "CVE-2025-22235", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22235 does not affect version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc. This CVE was fixed in version 3.3.11 (https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-9804539, https://github.com/advisories/GHSA-rc42-6c7j-7h5r) so version 3.3.13 is not affected" }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7c0f58c8-030b-5a19-b0ed-105682c5b742", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e5565d11-3f5c-5003-aa8a-1b623e977d46", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6104f6c2-8751-5218-b3f5-81190cb98a62", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3bd8f384-0449-5371-9c2c-d32e4b9ddd51", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:721c470b-1281-5d15-999b-476ce9be91c5", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:284e6569-1ac6-5913-b116-2aa5084353bd", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:790cdd9e-dca7-5d73-8bfe-dbbd4c4120d7", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc. CVE-2026-40992 affects only Spring Boot >= 3.4.0 (ranges 3.4.0-3.4.16, 3.5.0-3.5.14, 4.0.0-4.0.6 per spring.io/security/cve-2026-40992). The vulnerable code path is the mail SSL auto-configuration (spring.mail.ssl.*), which sets an SSL socket factory without mail..ssl.checkserveridentity. That feature was introduced in Spring Boot 3.4.0. 3.3.13 predates it: MailProperties has no Ssl class and the mail autoconfigure package has zero SSL/socketFactory/checkserveridentity references." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b3df8e5c-7761-58da-be7f-948580820818", "id": "CVE-2026-41001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41001 affects version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e5be1b34-2d4d-53c2-a2d1-5985335c1109", "id": "CVE-2026-41695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41695 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:89fd75bf-0852-584c-84b7-1fea51798faa", "id": "CVE-2026-41711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41711 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:12ef04c7-6793-581f-804d-5813f4689e51", "id": "CVE-2026-41721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41721 is fixed in version 3.3.13-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-data-r2dbc@3.3.13-tuxcare.5" } ] }