{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:68ebe014-b28b-51b4-9c4f-9a6a5a8d3cb1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webflux", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b0db0a10-60b7-57b9-b199-7daca8cba5ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-webflux and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:de764a4b-f4da-5878-ab9e-726cd288b82d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:95bb376a-74c0-5d97-858c-0dd81115ce74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:02acfc02-181d-5518-9534-8e62cbd7217f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1c6c9efd-8046-5a0c-98ef-3023adcf045d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2f8c532f-05a4-50ee-a3c5-26c2736fcafa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:33fc6560-a14a-5475-9ccb-1a65352d409f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1aa23b0b-faab-594f-aeae-1e9cfe37fcaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a83de3f7-6965-592d-a8b9-5e6df3982443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bf41f8a7-796f-5525-92d5-04ec722aa2cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b336c24e-8d00-5b2b-ad9a-7bb2f19032c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:10b8565a-e900-5af6-8069-2e8a48bb01d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9c2281e1-5021-5021-933e-3d3cb049b88b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:afce2e16-a5f3-5154-aaa5-808bc8e0522d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:734ada34-06f8-504d-9127-7ffd9d5b795a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e9e2feaf-a0da-5d86-9e33-d795720a106a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:160937a4-0ecd-5ca6-b45b-46a583c1548d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e19910d3-d8ee-5a01-b857-0a3b96422b17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d762d54a-5214-5ada-b0f4-c1e22f19ce09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-webflux. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1e944597-9fd5-5896-baea-34172367717e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d345f60d-762b-582f-b9f6-bac06d712ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f783245c-9063-5e21-bd8e-8bfb07d98b5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9c68d83a-9f80-5fd5-ac82-754bcd1266f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ee152696-5c85-5c01-8822-295353b4be2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4451f986-b8db-5f60-8859-698799de44de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d4ed8c0f-0dba-5338-a90e-d54c2b915d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5a6ac191-9a44-5b9d-929b-c4f11498e454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:01093175-02ca-5eee-aec3-4c1ad734633e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-webflux. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a4dac607-6395-5366-829f-eba3dab364ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:29d9e4fd-41a3-5bc9-9c4a-b6ba6e8b5c18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f64eacdc-7add-5ad0-b7a2-6c94304f66af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b36dce93-93b3-529a-a7ca-952440c60f49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5e1cec93-cf88-54cc-b064-ce9a9fa8787f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fc09d38d-2e47-5213-b8f1-40d6fad465ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:df6e8a46-db9c-54d4-aafa-48349d60251d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9da84117-d86c-5ad7-88bd-205844355e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:53e4fbb1-fdb3-509f-9d58-547a81ed3269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0c233a5d-3fd0-50ce-a47e-f5485fca5ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b424baf9-2bf6-5983-8cec-723dbe6daee7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c4828940-6b20-5659-8325-38835a0c5dbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b4112d1a-9c3b-50e2-9cd6-24c5191ea0d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7be18bae-0c75-56d0-af70-5f41bb1486f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:567bbfad-70e7-51d3-8ca7-5bc2ac885682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e1f7d581-8bf6-5af0-b6f1-9ece18f302ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e6676961-2ba1-5a40-b23f-d9a850cfd510", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b21c21a8-b5f7-55c4-af31-d69a4ccba809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ae904a3f-b01d-535a-bce1-3806947d91ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-webflux." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.12" } ] }