{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d4b0d4e-36d9-55d2-a25d-880e7b2dbf10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:da834a11-fee5-583c-bd59-e705a146b71d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:18f2cc1d-035c-5de1-8c28-2461c9339d4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:973c0a59-f935-595a-a745-dd31c33128be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2ddaeac9-ff1f-579f-aa0d-d41515a2f275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d76d8ada-a97b-5868-9908-6f5f278cd4a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7a0ea5e4-e4af-5094-ade6-157c68d171e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4b8f4c0e-4bf0-51d9-8b49-1a91a91f2d5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9ac168a5-80fe-59d5-b33b-79dfebfa9347", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0d17cbf4-c7e8-50ff-86d3-3dcb74761829", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:02abe033-44ea-5003-9e00-513cd59b3b17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:95bb167a-e6a8-5927-b0bb-857034b40d38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8baafd1a-db39-5d86-9696-19491c156e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:511c34a7-3af3-5d9f-b029-ef6b28e3eb61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:abc69f40-e4d7-5b11-8f4c-e87bec720949", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d5e36cb8-3e0a-5f19-b251-36775ba3f1e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6bd5eed7-e967-5052-9ec0-6ddb09dfa91e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:de310d09-4ff4-51e1-9363-d170663c103e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9225ba2f-1d69-5576-a1b1-4a53b7fa5e59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:eec0287b-bf9d-5c26-bc3e-7f8f9e5c8e5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9b353236-cfbf-511a-b68f-702f6260902e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e932c650-40f3-568c-9434-a6dc11d930e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:bcdc9133-bdde-505c-aa38-8d9eee03b556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:14941153-4536-5f97-85d3-c78a3dcb816e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a66dac1e-76c2-5fe6-8413-a4a5db432a6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:208c0582-7eab-51fe-93a1-ecbe723c3d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ca832c29-feea-5ecf-a079-79d6c5b0e4ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:59481668-9eda-5a24-aec6-6ed33f1dd567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:76859117-770b-5553-8dcd-2079f62709f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6c668846-3282-517b-a3db-e010a23455b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:eff93408-1f0d-57da-b975-ef6ae0c8411b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9dd9b977-43fb-570f-b7f3-3cc36360d3e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:bf032b0e-6d38-5219-b64b-3e1fc75332f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-webflux. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:118fa74d-61ae-5098-954f-e649f4d2762c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2f13f573-05a4-56c1-b84c-9bbc7fdddbf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8d702664-430e-534d-bce8-86c324a25312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:caa284f6-0b5c-501b-b233-782f44c89ef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0b7564dc-ee0c-579a-9a94-aee5d72cc4ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:49f84194-ff27-56dd-9fd5-348a38e8a0f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:78c1dd74-6a73-5684-89a9-9a1c27346537", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8930273f-b6b4-591b-8560-b344589d8f3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ef4a2e72-98ad-5d73-821c-e5e060a35238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@6.1.19-tuxcare.6" } ] }