{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b175fb5-c9a9-5124-8b39-6f2976689d0a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:390f9ca5-b5db-5032-b171-f15bfaf66200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ce895a96-047f-551a-8cc1-578447fa6137", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fab7dd63-6b3d-5432-bdb0-e789903c6ba6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:82707abe-7902-51cb-94f8-8dff28803488", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0791f381-8800-533d-9dd3-3fdcb208cd6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:05a5b230-43a1-552b-bab4-82ba48c2f5b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b27abee5-c5f9-5cd7-8244-0f6863efd5a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ae3097f9-d1a6-5c74-8c7c-2381b497257b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a32ea45c-9f72-5e3e-9482-b257c05a1930", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c2bbe966-2d0f-5c3e-9c88-e09ae98a4d96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:14f3074e-1cc7-5ffa-b1fc-1aac32a83c62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cc25f520-cf84-54a0-b5fc-dc3c8681f41c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a08cb1c4-5822-5e5d-b640-7405fa0123a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9afbf822-310c-5e8b-b285-3a932501bb4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c4f5a2d5-316f-5fb9-a6ed-dfe47fc3358f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bb3daa29-3fe7-537c-bcae-160c8fdbcfbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a5d674e4-cd6a-5a53-973c-b3431cfe72d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:77dff4ed-e821-554d-97d5-7de04fbac63e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2645e75a-6329-5a39-aa9b-18befd8bf13b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:131f66c3-6284-5743-bf1c-e0ab73d56b6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-webflux. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4dc4ebe8-3915-5766-a984-ae273b1b3af1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8e88addf-f5fa-5eca-a205-a238cd538c5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:46b72046-7766-545b-83db-cb1fae74f593", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7230bcea-437c-56e3-a00d-4c6a8b17243f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8585649d-6bdc-5b5c-9517-8bfa82fa4fa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:34377d64-3382-5aa7-8988-c6cf1ab9a084", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:877b2239-39b8-5d5c-9a31-f76bf2f88fa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f14c2550-f9b9-50b3-81e6-90c050def341", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:19ff1d37-69ac-53eb-9e0a-7bb5f408c390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3c7a39ff-1ed5-5be0-9276-405f85f7f10d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b62334a8-7452-5797-b099-ef1cc9ecb7ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d60ad1cc-ad40-539d-b735-b989d3f7d03f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3320786d-f15d-59f1-98e9-deeccd25fec3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8218fb17-930b-58d7-9ab8-934bc3074eba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6217f504-c64f-57b6-9444-83c48dcb02bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:502ba434-70ec-5439-b365-a539ac58b86b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b965bcf9-0e2f-52fe-b52f-71e0922e6a60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5cded072-f469-5836-a14b-c04ba846174f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4d200d8c-8e3b-5f58-a953-99467fc2bdca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:84cb0933-7138-53b1-9539-21a0964a404a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7ec47d05-1d3a-5378-8889-ef4e8e949f8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9ae7e646-4cba-527c-a6fc-d561d48b2a48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b46cfa6b-71cf-571e-8bf4-9f315b3bba87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5777b52d-5178-54e1-a420-6aa348fe0195", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1d5b82f2-6bc2-5d16-9afc-4e2786d7ed17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:56b09909-7b08-5c47-847d-546e81a9363c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:42df75da-b16c-516e-b6a7-c76d773c29c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:c4376ffd-142e-595f-bd1d-445b02c3e7db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.12-tuxcare.6" } ] }