{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ce769dfe-9e2a-5a41-b675-a4ae109d2bfc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2", "version": "5.3.19-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5b28ca3d-5384-55af-bc34-3ff5232a9fb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:89973662-076c-5071-9f5d-a11d20d707a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:a48a67e9-4273-5379-8b22-1084a9f67b89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:8bb43121-eee5-5c6d-ae60-80f8ff0da8f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:a7137e07-0c6b-5091-a0a8-c05cdb3aa991", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:291894aa-6e55-582b-9556-97bb10ad249f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:485e2d44-1c4c-590c-a63a-82aed3218f01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:14e9b8c0-2437-59ae-abc5-13de086b2189", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:09919a64-9eeb-5e23-9eae-9d63b8787db8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e7703e66-ff83-506b-b23e-a09ccabf36db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:523cbc9f-4f41-508e-8497-53f1c7f067a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9793dda5-3449-54ee-9f27-5bee7646f940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:cf18e32f-910b-527d-8844-2200cb4d18f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:8d6c9253-644c-54d0-a037-4bfc856dc767", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5f66d965-64b4-5782-b8fc-773692e1776e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:0751a91a-39c4-5a31-9f78-f56aa2d4b6ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:1d5fd12b-44fa-52c0-a3d4-c0a0ee3599df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e813d4bb-6bb8-567e-ad75-3be0e682bc83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:dafadbfb-8323-5dc6-830f-581993e5060e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:556d3d2c-ae54-5a2e-9e72-2ce469631c13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:67a7c2fb-ee7d-5655-8d7a-107bf1055aa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:72b10d8e-827c-5fb6-af11-31d93050e752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:6b81a00b-ae3c-5399-9c37-2152833739e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9f041337-06fb-5500-bc1d-a60264e35dab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9320c96f-4a7f-57c8-96f7-438b95cb2e6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:7512ead2-594e-5336-8f25-2b5f1c79239b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9d1d54f7-34d5-5ea0-8f87-b04d010626df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:88da3d4a-ea95-5115-9ca8-a12200887abd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c7577130-c5c5-5564-bbf3-56258abe254c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3da4c704-88fc-5317-9b62-93ec46a460c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d5498247-7164-5325-bf25-103e7d63a062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:09f977d1-c4ee-5782-b2ad-c9c4c325a5fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c9ef3a59-ecf0-56e4-a341-5bce2f32b654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:86a1aff8-1073-5b0a-9769-e00177ab73a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:109c5296-f944-5c4e-b4ab-5e0dcb3f21d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:1bf1c1b1-8af0-53c6-a4c7-1a2e7a79edfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:8f2702c1-6ca3-5c56-91ee-a120fe442a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:1b209ba0-91b7-59f2-a749-05eec9c92f8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:da1ce16f-ee07-5c6b-8602-a24880bfb27b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:8bea2212-3f2b-5aec-bd97-e16c5ef7d429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:77861874-cace-5fe7-bab2-ec742ebc5e50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:42f3decf-e808-508c-a341-5836d4633f47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:e2d4f6ab-815b-5c10-a2ad-efb0b9452103", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:f06e5b31-44e4-5185-b0ab-673d68d0829b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9bf29547-f4b5-5a4b-8ae9-43778ec3e1be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:fc053a10-f5c0-5ff1-90a7-c6da47f7466d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:882d302a-5810-595b-8efc-a393e55aaa83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.2 of org.springframework:spring-webflux. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3e0b9b56-2fff-5a9f-9409-69485099269c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:f6b0f09d-fa5b-5938-8c64-155ae44b221a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:d73281ab-7f3f-5244-9bf5-58c37e3e7879", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:bde27ebe-0ce0-5572-98c7-2606280b293a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:b2198e59-2635-55f8-960a-5a0d30a1edb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:efa1fc4e-423f-5eb5-96eb-8d8f3d66ab2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:71f9da7f-3aad-50af-a37c-7f3c61617375", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c4b9ee86-c362-5c3e-8992-ad765f15c809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ], "bom-ref": "urn:uuid:3abcf6c0-db17-5576-b021-3acb1de15c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.19-tuxcare.2 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.2" } ] }