{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d11f3b25-3cca-5066-8bc2-3d116edbf2c9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:966c6bb5-a96b-5bec-9c00-101ff3b777f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c5ef5c3-4b54-549e-a751-bd356e514020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d030c5fe-ca3d-5625-97e7-770eb094f7e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7344538c-4618-57a4-b6bc-9b1db7e20d49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:01cd2303-6f20-5af6-8d9b-7d4e724d76f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c0033f9-a3b3-57ee-b933-0c5204c11cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c31b9796-46f3-5df8-a7de-0bc691a12bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:541697e5-027c-5882-957d-578dda118b8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9f91025b-9f51-5321-b66d-d9eb45402f8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:457687d3-130a-50ee-b231-853be278bcda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bd1eec2-ef9d-556e-98a7-1fb1572e3d8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:275c148b-d00b-502e-8e8f-3c8a3d9910d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:61201b77-f0af-5dc5-b5c0-bfa4921c0c6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d4bdf31-88c5-5548-8e89-bf450a1c7b41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f6a8027b-5e6e-5776-a05f-be2a1790ea8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c56e6fb6-1f06-57da-80e5-5e4b617e7ac9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8db6fc79-308c-5527-a413-01bcb68acecd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e9da5b8-0dd8-545f-9787-70cab4854817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:136b4a85-9a75-5116-9c56-096d81c49819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:054f626f-1ca0-503a-983d-3a76f7cfab2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:36860445-db97-547d-a351-15fe40185674", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8e23417a-93e1-56aa-bd07-12bfa1777498", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc868eec-6a48-5340-b52e-6c9da5701996", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6a73de4f-9c4a-5051-9a14-311c01376364", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b951b07-46f5-5ac1-8429-190ea7277efe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:805b6246-39b9-5407-9265-321d10945b06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:33b18237-b476-5810-9b3b-7792fffa3657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:079e5078-c61d-596b-9202-01063f90bed5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e2ce1ad-4fbf-57db-b237-a9177b0a1c88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de47ca80-6f5f-5f8b-80bc-379c2a88a9df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1a4ee213-ccfb-5cec-82a3-6a46d0dedb54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6981499-b668-54c0-ba76-2760831baf7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af65fcac-7554-5023-a4cc-567eb92f3951", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2cd1efc9-bdcd-5971-8f95-94716a5e1c5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ce4eba5-2290-5887-869b-5b89cdfab0ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f31469f8-f7c2-5d03-843d-c65c28ef205a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f7a190ce-3189-5976-9ab5-741cf52d2a79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:66d7ee54-8fad-594d-b150-982499b207c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e0b155c7-3f03-53d9-95ce-865c92632ce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7abc093b-9697-54a1-85d5-e81673e25f9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e495869-d8b3-5c8e-a4c5-b23e904bf623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:46044b39-2d5b-55a6-9d43-494f0e217865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:996c3d83-73bd-56f9-8ca8-e048df3fcf9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0aaaaae4-24fc-5568-840c-719b5684adc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:37a1f588-99ad-58cd-acb0-c856c0f8f0da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc9fbde6-142a-5861-870a-2f84b3475494", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5381bbd4-48fc-5584-bd80-fea0811c5f7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10685330-7402-58c6-bde8-cde451091cfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d81fd9fb-3787-5644-bd5c-a4760ca6977b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b079ad7-7fd8-50e2-8398-65bfec975023", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91534786-6deb-53fc-89fd-c387bc659c69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e78b4fb-ed3c-50b8-88af-d0e3fbc07664", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7afb7bdd-22bf-542e-9f24-ff4ddc90233b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8dff1cd-a160-51cf-97b0-1434957cfd76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bdd78ea6-14b9-5752-b4f9-3be0f7a2a9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b55be037-6398-5984-bbe9-07ca05a740fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4d839d2-0a63-52a5-af46-6c222ea5dd8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a72e184-1e1e-51c7-972c-792db8d09e85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e1e55d4-67dd-5ec5-a2bf-aa09ef5df83e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ac784498-59d2-5433-bb8c-f9e6d104efe3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b49eea0-70f9-5af8-b1c6-e1f727b0deaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f31841fe-a812-5910-97b9-092b71737a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.8.RELEASE-tuxcare.2" } ] }