{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cf0478ea-683c-5fc1-b07f-e8412bc6ff0f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a91d18ed-bce6-5204-930f-6e49aa531b62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9506e18c-2edc-5d8e-b7dd-6d64fac866f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2675f1f2-9282-5c6a-bf14-f1e849d35a80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2d679ed5-c2fc-529d-a0c7-eddd4e08bfcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9a47808d-8250-5550-a9dc-d3bc1bef7136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:277f4807-8358-58a9-807f-adfb661ba8fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:eb2e9869-54e4-5bc5-b6c4-d0c5961998ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4a97e295-42e5-50b1-b9c4-a3482b3558fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:31e0e17c-ed04-5b44-bc8b-5bf18b1e8b1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f3d9988f-c5a6-5aae-91af-e60026277303", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a2f45943-cf29-5fc1-be34-88daa00b8282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9ba659f3-4d30-51eb-bb48-ccb57407e6fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:658453a7-c8ce-5b4b-aa1d-f66300f88f43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:047c77b1-351c-526d-9638-31eaa2da5c80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3cf23936-cb00-5b18-892b-ae81e100fbdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d09f408d-3061-594b-b419-ed0546527c41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8b482583-385b-537a-a56b-47ccf591a6f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3dcb6430-de1f-500c-b6a1-815674eb3842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fff02b3b-478b-5363-adf3-69ad9cc65fdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:91378c02-30f5-564b-aea0-e5b8560745a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6ab5225f-2868-5eb9-a040-080d9d86ff23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:755f67f5-a429-5dc5-a823-7e889f84792f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:759623a4-1b60-5da9-98ba-5f8b824a2351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5b3a9d24-609a-5f42-9852-eba8a2de9f42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d2748bf6-22b0-555b-afda-323bcb45f731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a0915f5b-97c2-5ce7-ab2b-ea22872086ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:509bf2c4-68b6-5870-a7a0-851a95444177", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:515ca5fa-f694-5083-88a1-76bcf4823a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:821e069a-ca14-5841-a65a-d74c890ae3fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:10050b3a-95ac-5603-9749-476bb8d9860d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9d64e372-bdd2-58de-8b77-1057855a800d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ae5352cc-6ac3-5b1b-9796-1b07f8eb0ce9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b7695439-50c2-5cff-a3bf-2777dcf7a865", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3d341faa-59b9-564d-a4fb-60397447ae6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:290e9ce6-778e-5723-863b-113d6e459555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c671a0c9-4b46-5827-9dcc-26e052f1798d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ce95f576-ed29-53b9-882f-f7313b77aff9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b0b17b7e-e7c1-5d8a-8b1d-fdf09e90c2c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f7597254-4777-5c25-8a41-ed1034f58c38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f42fb1a3-6349-5edd-b518-8f808c31e985", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:54e3e08d-74f9-5586-b999-0212abb2c7b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8d8c7888-392e-5414-ad56-ab25d04cf137", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cf59feff-ff4c-5e67-9b71-d148b66908a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f1d1c980-c1c9-587f-b290-2d2b7cea3953", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7f14dbe7-d8c2-50cb-b331-e694afdb4d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8fcbdde3-d51c-5a1f-ac7a-bd43c1fd9157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f17b2d7f-92a1-544d-817d-a7fa648f9cda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e103bcaa-7bdb-5e50-8e1d-aed24c37188a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.12-tuxcare.6" } ] }