{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6fe06077-b427-568f-8151-38a39a988ddc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-r2dbc",
      "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2",
      "version": "5.3.13-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-r2dbc",
            "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.13",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:61a12dc9-54af-5514-b1f2-e030e0c3ed16",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required",
        "response": [
          "will_not_fix"
        ]
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:de2b78c2-5d31-518b-b039-55c764a88a6c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3e11873c-697f-5a55-a95d-2293ac83586d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ef4080fd-e395-5b5f-8baa-7cc35e303fbc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2a46b87c-46ae-52a1-8b59-d221f22b1294",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:606b0907-e5c6-52a3-aba1-5f91023671be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6702f4a7-4269-5bcc-a597-d0c2483dc19f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:61c830c8-3f79-5a79-b670-b1283c1b1247",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:869a65a8-305d-5729-9b47-8e9a282e1e19",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:28c67500-b5d9-53d8-8830-d48edeba25b4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fd99ffcd-9567-534a-aff6-1001fec73ff5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3594668c-6da6-5c9b-afde-e37acc7894f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a7b63b87-869a-557a-b3cf-eff305d58631",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6789bc4d-d6f0-5672-8bd0-ad4519a74449",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:69de726f-dac2-507f-80e0-960186a1a447",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-38816",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:218f5e77-f7a1-508f-94de-bf0e1a3fadc4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-38819",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:899be8d2-119f-5e06-b031-4a8e890d2981",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:97cd8e2a-58c6-5e67-a545-903c8f9ae975",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc. not_affected \u2014 Version 5.3.13 is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() bug in DataBinder's field matching, but version 5.3.13 does not contain the vulnerable code pattern. The CVE-2022-22968 fix (which introduced case-insensitive field matching using toLowerCase()) was never applied to this version, so the locale-dependency issue that CVE-2024-38820 fixes cannot e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38828",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:daa8c256-7074-5110-a2c8-3e01f208fa22",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38828 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc. not_affected \u2014 Spring Framework 5.3.13 is NOT affected by CVE-2024-38828. The vulnerability was introduced by an optimization commit (gh-31834, 0970b1dc7a) on December 13, 2023, which post-dates version 5.3.13 (released November 11, 2021) by over 2 years. Version 5.3.13 properly allocates ContentCachingRequestWrapper's buffer using the contentCacheLimit parameter, never reading request.getContentLength() when...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dc7682ff-9b5a-5bb1-a897-9370127ca4e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2025-41242",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ae224c67-5277-5b2c-8b99-1734b6a248d7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4d26669a-6d98-584b-bfc1-8001f9f34e9e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2025-41254",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:79cec928-0f17-590b-9335-77a656a60fb2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-22735",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:09a6b4b5-05bf-5ef4-9ada-2921f20c6d6a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-22737",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5b1e2372-524b-586f-9c9d-dbb96f2764a5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:10ad1d82-a81a-5ea0-aed0-34d064ac7fea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-22741",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d2394584-9586-56a2-97ad-d573d4e3ce70",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-22745",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1ec02f80-d50c-5df9-88bc-cd7009aefc23",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41838",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1abfd0eb-cbab-5fc0-9966-4a8d1eb862a1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41838 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41839",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a27c6629-aeeb-5649-a909-1c463ca94004",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41840",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bc101ab6-bd3d-5786-85bc-2553a4b6d6ad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41840 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41841",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ecd955c4-36d2-5e3d-ba70-4f2deab64737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7c758bcd-2f43-5dcf-b330-823d43b6a324",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41843",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fb7b0f7f-f4f7-5747-a721-f885396bfb5e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41844",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:500d2373-3a97-5e71-a76f-09550a7cb034",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41844 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:866558ed-62a8-5e46-aaeb-0f749a8172fe",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41846",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7c4e1a72-15ce-5136-9e1a-6cdcce162348",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41847",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:15dedc91-bb95-5e58-9a03-c7c8b62bd9ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6381350f-b46c-5f46-a8ef-e76b07d768ac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:259f624a-9569-5694-b8f5-94f5b36daed9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:56b4267e-e48f-57d4-9e8b-0bc0c97d18ea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c585d1e4-33c3-5454-8bda-8bd7c09df3e5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ea8a0b2c-f66c-591b-9216-1f165977fe45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41853",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33bfbb96-6b03-58dd-bfb2-e78a2ef5ca92",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:99c13d6c-ba34-5936-80fd-6636fe79423b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-41855",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7f9abb3f-4e79-5802-8429-56386136357c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47884",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:44eb92b2-277a-5c92-bcce-e5c0613a65c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:44a14d7e-8c20-513b-b727-58db72b27a96",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47887",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d3de8bdc-61fd-514d-a85e-9171feba537c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ecde1722-70c5-5c2f-889e-f3f689c25734",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47890",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:061e521a-167a-5f86-b563-a8c6d889a1a9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc. Target version 5.3.13 is not affected by CVE-2026-47890. The vulnerability requires SSE (Server-Sent Events) Fragment streaming functionality, which was introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.13 predates this feature entirely - the vulnerable code path does not exist. The CVE affects versions 6.2.0-6.2.19 and 7.0.0-7.0.8, all of which postdate the target version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47891",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f897879c-dd5a-5b51-b9e0-40c66fcb15fd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47892",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:03f9aa04-1d60-5bda-a91b-41fd7c3f8fe2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-47893",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9ca7b2d0-7c39-59ae-8876-4f731ee243c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-59280",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9a6e497b-b32b-528f-96ac-69a8b6bb5672",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f6b0c5e5-cced-5c2e-b7ff-a89d156b64db",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:605089b7-c6fa-5234-81ae-55908013511a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1934ab75-595e-56a6-bc2b-7f744ecdb9a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-59313",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:01418a77-4716-59b4-ae95-6b624c57ac80",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a4df86ad-088b-53d6-808b-e723ea7d75a5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-r2dbc."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.13-tuxcare.2"
    }
  ]
}