{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:06116ef7-1013-5e5a-84c6-4022618976b9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2beb81bf-5454-5fed-8cd2-bc69c55a8ab5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0182b5ee-ce5d-5528-a368-4984ea8c537b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:954855ac-a2e0-5f08-8cc7-c0c47f405032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6887d28d-2dff-56b2-9215-c3b2cb968ed0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3e5d394a-4812-5840-8de7-99d9a0f6eb52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b452fa24-4509-5595-8ebc-df90d62e28d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ce4f0715-c0f8-513d-954d-f4c246dc479d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5341e696-a928-5670-b589-80e3cb797db9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e23dd06f-49cd-50cf-b811-98bad94f0de5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3b1849c3-5ea9-5975-8f0d-91eff4779bcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bb894c3d-dec6-5106-a18f-d8d55786858f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b6ed4a75-326b-54ac-9070-73b0a8a2185d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dd2eba56-1bb3-5b81-97ab-753fb321f788", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ffd55fe5-d471-59db-8f18-6d70b9a29d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:28f0895c-1020-5d74-b4a6-e07903af04ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:81b4e7a8-ff36-55f5-a8af-405667846cb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:50311cca-d7f0-594b-96fc-4b66ff866c0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:59001906-00b7-5e43-ac80-c1744c6bd2a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b78696a7-8c15-549e-95ac-ccbdeb37badc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cda93e3f-a006-5abc-9383-b9f20546f26a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4c54f2f7-b7a1-5020-85e0-063d6827db65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4b101126-d03d-5aa0-a81d-fac7489f58a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5ef514b2-ab65-5ac8-8ac1-65994598e4c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dd771b9d-ce93-5d7b-b908-a154273d2b8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8439283f-3c2c-593d-b9eb-e15f59c1d612", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7f8b3a37-3579-5387-9921-a83a03de27c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f104ba15-121c-58b4-96d3-02c9d6a8084b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0e9d3b20-a422-5d46-a03d-16976abee438", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:049d489c-99df-541c-a3ea-797e25d47b5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:01ddf0b3-c81e-5475-865d-defc479c58ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b64af58d-5ba0-5c20-aec2-95ddae113d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b7c84553-9225-520d-8a61-ad3c73f43212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1192e52c-98ca-5aa9-aeab-992d406e9abc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0ef15df8-78ba-57e3-9724-87c9a84c3531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:90beb219-f9ce-5c4a-b541-d348a0f53c0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b6803c82-6b13-5bfc-b13e-bc8f51b6fe8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9d71fd99-a60e-516f-bdc4-e84c008addb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:678cf814-22f6-51dd-92aa-6ca3dc3197b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:49a705d9-edcc-56cf-aaad-9ff03dc659b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f5a6fb9c-60eb-579a-922e-f3db06e3f0e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fb9faf91-1445-5cfc-b84e-0ebad890d075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7a248058-c6b2-5a23-93d2-2b1b91f14bb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9c394364-4dd2-5fb1-a8e3-cd6e45dbb762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5711875e-02aa-53fb-b36a-a82843ec17a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d1510c30-60b2-57db-a14c-f73bad760e10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c0879d37-531b-57da-a2f1-f59c6b94ae57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1d0fb226-3876-5032-b298-d49e7541a9f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@6.0.16-tuxcare.10" } ] }