{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:45b1a84f-8fa8-57c8-aa0e-1a29a8bb09c8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7f6644bb-97a0-51a1-82fb-021a8b4e12dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3fbd4030-7334-5d79-b07c-71f1bc526f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:79a2e9ba-152c-5029-8f76-06d6d97697ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:53361e64-5fc3-5546-9f81-e84cbdc98b7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:54980d78-7b9e-509a-b4e0-db49f31726f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f6fe6179-0936-5502-92b0-023db58ded24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1374e6db-a47c-5b0c-a049-5390d92965cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:14fb7340-d132-5115-b3b6-283f2e76b7d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ddccee92-a686-55e8-ab82-8017fbdd8755", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:56fb4500-76c9-5fc0-8607-117e34c70742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f50bf157-8b63-5939-9dc5-e7f443d75e84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d7dfc89f-082a-5e75-b761-413c7468712f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e59b7f15-34e1-5385-8aac-1ed1932af528", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e65c6f68-63ca-5aa5-8fdf-664558b9c4e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0030f412-0eea-5fc8-9242-261976c96920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f85e4dc7-1a85-528a-b813-d93b85e639e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:27075c77-11c2-5df4-bf01-bdc5f4a191c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6f1b7cae-088c-53e2-8bd2-a0609f5cad29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:047566d9-652c-5432-a94e-8e9d821d8674", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ee0e1a1c-4e23-56eb-88c9-1ebede843930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cea389a0-d29a-53c2-a93e-0ade1d8bc5d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a6dae473-ab02-5f5e-814c-abd54f73bb88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:52ca51f0-a850-5512-96fa-8ce9d7f8c077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:676ea21f-01bd-5122-b85c-0e5aec323b8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bc7934fc-0c8b-551b-9075-bbe8136dd628", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:06c36e53-aa18-5cd7-b6f0-2c25f5c95203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:31a9bb55-680d-580b-8641-8060ad517312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f1134a73-42d2-5ba8-85b1-e37e82545f2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ca57c5aa-76c0-53ff-9a0e-3c6f3a2b6ae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:842bdc67-31d8-5025-9481-46a5940bd032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0c26e974-1300-57eb-b4a9-31054c776ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:aa0e0d82-c83e-50c4-a62a-dae16eb1c8ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:626083db-d960-5a8a-8c8d-dab6a23a068a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4e1ffba0-04e9-584d-85f8-bda92726690f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-webflux. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0fd4c926-bddd-52d8-bf7c-8273ff4bed15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:99290505-05ec-5e79-a851-30a424145951", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:63f1dc20-e413-5de8-8a65-63663250613a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7a8bf17f-a626-5a11-a44b-f983ec5252dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b3c6cb36-5733-564a-b66e-a72545a74df5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4703ba2a-de5c-5903-8cdc-62812a5b7566", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:28bd695e-6d8c-54c7-b3fc-da2db7cb1650", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:200718bc-a21e-5459-ae8d-4f515f504067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3c8a2a59-353c-5ca5-a1e5-3546fe5f76d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.0.23-tuxcare.11" } ] }