{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0cef88dc-f253-509e-aa58-c0ff5c970901", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:76dfe0dd-7781-5c12-b2f0-a68568f3b72c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bffe9e12-8557-5762-9b11-a494085f1c0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:05595690-212b-54e5-9c23-61971b44c0b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e23d8902-3852-583a-b8e1-6aadf90a76b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9839ff32-5f24-589a-8e82-6b641b9bb742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:57541fd8-2bf2-5d54-9046-52ccb3fa3cc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:97dc5eab-e61d-5edb-ad22-7ccc89c09438", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cc5ef5ab-fbdb-5e92-91b9-a1106451e60e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:870d6be0-2f68-5486-b456-179e15ea8bbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:797c1f8b-d0d0-5d5e-99d8-c7494c8f33de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:82577357-c672-5665-bf9c-f60c080e6f89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:385b6b88-1f44-5e87-8953-4ae5db37f931", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d189be61-3bc8-56e6-9b04-d6c5974a5684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:43d87961-508d-5482-87ae-beb52744727a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ef2c9186-7b9a-5ef0-8d7e-c682ace84332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fa98699d-fd9e-503c-85ae-717b04a4a112", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8a8e616c-d028-5e49-ac32-20ed68816015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:baee8f4c-43a9-5a6c-8b4f-a06e195a7877", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e2f70cfa-b539-595b-a5ae-49652c6dad9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:545e6251-7ecd-54a6-8dbb-a1de2c264206", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2fb705ba-0f3e-5374-a7ee-61ed60d33422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6eb4ddca-aa4b-5e51-ab67-682321cb7d66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:be6de92d-5a02-5cb3-9b2b-f21a33dcdada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6cecd75c-a276-5cb9-a0e6-e02c4e3d05af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f09e7bb5-fd7e-51ad-a20d-d5bf09fb97e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ba7bcdb4-2fe4-5f24-9b49-9792c1b982fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9a2e29ba-7016-50f1-943b-4728bf469778", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:03f8f463-14d1-5945-bea8-1a52b31a01b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:846d140b-5ce0-5ec6-a653-655741c3a00d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bc19ef9c-adcd-5bd6-8d27-9abcf24f7d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c47ea10f-6da3-5b44-9538-72eea129f46d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2305bfc7-40cb-5b1a-8dd6-94fa43585707", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a9f66c42-a223-5215-8510-43f89ba3ad3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4dfdd1fb-25bc-550f-91e7-330cba0f63d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2357eeb4-6636-5843-a67f-0e41c33492b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:55946d39-9dc0-5378-90aa-d37ef7e00ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:68e21499-378f-5d51-aad4-a7ca70d78864", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a61dbc95-1022-5f09-a75c-e90bc0272168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-webflux. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:19b4f84e-2d08-5ef3-a518-2156d4d006bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:432e6b08-f000-59ec-9979-3e264bf96f28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9b1bd20f-7466-5bb1-8935-f2d2b05e50fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:96d21ad8-a2f2-5213-9f67-b492d6b91032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:33e1086b-92a9-590d-9ec5-fc53cf566515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:11e99548-c7de-5293-bfe5-d284e069b057", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6038e69b-e4e7-5de0-987b-868edb070d79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7a3d2f1f-7f61-5953-a1a2-581efbfcdea7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1ffe2dd1-db13-5352-b515-e59f4faba393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.16-tuxcare.10" } ] }