{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:95f2b7cd-3c16-5010-8f7a-4ba78badb353", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ad0dedad-d0f5-547b-8122-7720157d67a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-webflux and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dc231549-313e-5919-839e-e748af489d79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6ae1ea33-d6a9-55d7-be1d-583bbdd715ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3096a89f-d41f-5ed0-a188-ba5d7d5d08cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4317ddb9-cfe6-59be-b5c4-35480b819b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d19f6d78-0ad5-53fe-a616-99861b88c365", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6b411202-55b1-5a36-8aa7-75f8df4ec40d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2d9986ef-411e-55bf-850c-1be41c37a913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c0671255-58b7-556e-83a8-2eb109c03957", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4fb99d2e-48bb-5c96-b3cc-7a1d5dc19ca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:87835d1b-5baf-55c3-b7e1-2aeeec190bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bcfa6416-42f2-5d25-afcd-efd60ea9e456", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-webflux 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c7596276-d7cf-589f-8088-309406ab2a68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:482372c4-26bf-50c7-8dfe-06cd57a09c8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4cbcc0df-eac3-5cfc-9c1e-1d214532f539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:236a1194-d975-5c3f-b33b-3d030131742a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9d497a83-b56b-57e7-965f-6d06d769f955", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ce09dcb6-07f9-5967-8410-001102c3e9e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b6133947-2008-5a5f-a7b7-c7a6e6a15a57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:616b9a83-fcf1-56db-8e71-116cd2ba28d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ac7b8643-ed37-5fd6-bebf-38ed46beb216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fc227f93-35c0-5f65-833f-56a6c79be419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:490ffa7f-049b-5839-812c-4a337afddf2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webflux. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4a89f08b-2993-51df-b067-87d253b97d01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:008cc6b7-6d03-589d-b448-40cc114f9774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ffacbefc-b811-5393-a0e1-ec9a547d9c5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:34c0f775-ec99-5a57-9202-ced48e21fd18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9a70942e-c878-51c3-9f0b-840342088893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:25c77f0d-15d5-5ac9-9d35-4f4444023e7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fbe3b9ca-a530-53e6-a3e7-be117826c325", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bbaaaffb-b98b-55ae-a3da-0481c6bf2be3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b512ba97-a73e-596b-8dae-ed36c339e466", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:aaf80dc1-f342-5add-baac-bb12447d8259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d140c349-3719-58b9-97e0-e8a590455151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a4074585-915b-5e95-8148-38db1dc999e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8280437f-6ab9-52d6-bcca-ce72a92cbba0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:df88aa12-8304-5a11-8ed6-ebbf899dc1d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d893a8cd-1349-57c6-9ec4-d12b46a5f46d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:daf2c1d3-6a67-5851-b2e1-e22041b38cca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f192efba-5277-5597-9494-d9960b609fa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2791ac9a-6d4b-53e3-bcad-1ba8c6a0ac9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:98e66a46-2590-5851-962a-f377ee3c4d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3a92a102-5b5d-50aa-b73e-918ea9494f93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3a8355d3-c712-5c98-b95c-124d4344e880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ef88c434-7bda-5152-b7b3-6fb805f07934", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:99355846-0ecc-5528-9079-248977194742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:afda8f87-e931-5cf7-bab2-967249a4747d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:14315c0e-4ba4-59c3-aafb-fb4240efa5a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:eea5ff2f-f899-5563-95ee-506742cacd9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9f007a44-0cc0-5d8f-bf77-2b7e7ff817c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7a8f2255-c74a-59ba-9dff-1590bc09937c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.29-tuxcare.11" } ] }