{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:49971f33-af72-5c65-94cd-e42bc55a61d8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-reactor-netty", "version": "3.3.13-tuxcare.15", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e6086861-3407-5d3d-aa20-a76054bd9a05", "id": "CVE-2025-22235", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22235 does not affect version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty. This CVE was fixed in version 3.3.11 (https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-9804539, https://github.com/advisories/GHSA-rc42-6c7j-7h5r) so version 3.3.13 is not affected" }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:2b5a34d8-bd32-56d7-bde7-24b61ed98172", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:d089aea9-a7c0-595d-8603-8f9ba878fe7c", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:46047bbc-9d70-5ab2-bfc1-be96142d503b", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:8220f5ff-b7a6-544f-ab79-354511266d89", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:a72790d4-8433-505a-a725-08d2470fbad0", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:62c1057e-48e4-5aea-8ee6-6dac99a84418", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:274a0766-c988-5a85-aa9b-53d54aac5488", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty. CVE-2026-40992 affects only Spring Boot >= 3.4.0 (ranges 3.4.0-3.4.16, 3.5.0-3.5.14, 4.0.0-4.0.6 per spring.io/security/cve-2026-40992). The vulnerable code path is the mail SSL auto-configuration (spring.mail.ssl.*), which sets an SSL socket factory without mail..ssl.checkserveridentity. That feature was introduced in Spring Boot 3.4.0. 3.3.13 predates it: MailProperties has no Ssl class and the mail autoconfigure package has zero SSL/socketFactory/checkserveridentity references." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:1ac8915a-ca0a-537e-bfbf-306079d84aea", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:88575206-18f4-5a33-bdde-9cbe37008029", "id": "CVE-2026-41695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41695 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:f49fa37e-5da2-564b-81b6-9fac640671a0", "id": "CVE-2026-41711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41711 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:535d3cb3-f045-5268-a5ad-14d0744358f8", "id": "CVE-2026-41721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41721 is fixed in version 3.3.13-tuxcare.15 of org.springframework.boot:spring-boot-starter-reactor-netty." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-reactor-netty@3.3.13-tuxcare.15" } ] }