{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:67a68559-0c9e-5155-a80c-80e4da96a7f3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cff076a1-808f-5b54-9afc-357e9d441ceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:98eeb713-adbc-5113-9f8e-40b15dae531b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:becad49f-c7ce-5f98-bbf3-e42da8837890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cf54355e-92e4-579a-96f1-822295ae731f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f52417c2-2d8d-5f3f-ae38-f1d46c7300db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5fcd3662-e228-5101-a5c9-aa6a92fae8b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:31bc36bf-14ae-5fe8-a6dd-2b0ee6a74326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a476daec-05e5-5cbb-a78f-77e627fc90a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bbba8edb-a17d-53c9-a33b-9ddc64d14cca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6d555a88-32ab-5f42-ab04-c87042a200a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dded1101-1976-52d3-a00f-9cf74efaf145", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:591baac4-9792-51c1-90f4-5cb51efda480", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d0618b6c-ac1a-5c9a-a5a6-16d7b0b78259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d9c239e0-0465-5334-a0dd-2ddbc6549f62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e0c55486-caa8-5707-bcfd-0e4c8ed0d348", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a053455c-23c2-530a-b71b-2e3babd4d880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3474095b-fd35-564b-820d-2f98c81848ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7d3a2985-28b6-5503-9f9e-0edd74744c66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:82ece1f0-ee84-5227-81d7-56427157a7a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:aaca9e46-77a2-59f0-a926-9d79df810827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1d3d8e60-6481-5105-92ef-407af784bba6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a1a38756-f949-5443-8f07-5277f19ce14d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:65cc0647-d4fe-5ca8-a2ff-756ae267ee62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d343733f-b472-5c5f-89a7-ce9b6e7c018e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:25eddc71-51c5-5e4a-a760-ab3c766ee08d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f607d8c3-14b3-55e5-a88e-9e7c4b316e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c40429ec-4f2d-56c7-b86f-bfcc98d4c68b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:35affe9f-2b64-529d-b61b-8f428dceca70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cefa17ba-6955-5a2a-9c5e-19db98c274be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:afae2135-a7cd-58bd-9f82-baa7de1ccd3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bbb70ab1-4e13-5f47-aecb-5646e410d760", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3e97ba70-1bff-593d-82f4-2ec877b35626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:43b3731a-ad7a-57b3-b24d-4270c1c139d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a6552d68-2d54-5a5d-b936-b9012507856e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2026d534-f593-5426-b24c-38cb7c3183b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d082bdc2-a027-5b8e-98fa-e5c752cc1201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:946912fa-c924-58b5-8680-9afe18d6011a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7aa30be4-e8a3-5c49-886c-fdaed9d88319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d45b33d0-1a5e-5274-8238-fe992a13f9f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dda6b918-a2f0-52f8-9001-9e8c6ea59b43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d525b75d-c553-587c-9740-c51825959fab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f5fd76e0-0994-5fcd-9cd6-8ee908d5faa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:84fc13bf-3b49-54df-ad41-eb8845e3a6d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e2bb2dc5-26c0-5243-a3e8-ddc371c960ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6ac2cadd-9294-5cec-81d3-c01690f76684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c90ca9f0-61eb-524c-84e0-6121037a0130", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:be143ab9-2893-5d42-ad24-b08239ecd981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d3c26236-5cc6-57a0-a454-90b5dae91f50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.11-tuxcare.6" } ] }