{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:74c4c772-6e7a-591f-813b-83ce896c61dd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3e3c40d9-defd-521b-a752-8f3babb7c82a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:40f7e949-a9a1-590a-bdf5-6a4f9948b18f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:86c45e78-2864-51dc-bfb3-e2fe61837be4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b7d2d94c-b8e5-5522-a721-4f431b074cba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3f6e6573-fa63-5455-a13d-12091f23360b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:641e2fe9-c72d-58de-a931-cd21ee4e3abe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:573990a2-87cd-5c3a-9ace-b69a238bf035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:54fe8d00-1aa7-5904-be58-c923373c62a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d5e20d39-9f3e-52e3-a6a4-df4159f02e08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:be3f839d-ef70-59d0-8d41-94b1990d6e33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ab39038a-c632-55e4-816e-c49da85a49a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:124ac8c0-401f-527c-b0e6-d21a64095c2a", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-r2dbc 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e95b01b8-bbf0-5328-a6bc-5888de3dfb25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:87e7e85a-8323-51ca-ba2a-87ea7204eca7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0b0d6998-f496-5705-a92d-ad2cbe1fe0f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e6ba56c1-bdb4-5c45-80c0-2bc9341f1326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5070fd89-0e50-5a48-9d75-27518fcd3cfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:da757cc1-40e9-5ab4-8b58-e44244f18618", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8443c5f7-a632-5a67-b0d6-bbd41a52d249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3611e495-1200-5c99-9629-625be2557b9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:99df373c-504e-5367-b675-d996381a90a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a0f8ed3f-474e-5a1f-9004-d47b577241db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:391e4b44-214a-5ea8-aef0-a790708b1346", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f90e091f-6d1e-5844-9001-dcb469424e62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5edf3ab9-f31e-5dd7-8683-323e6041dc20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2a38a802-a10b-5021-a4d1-d92d9288b6dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:71b00b57-b5cc-5185-b0ea-0bd2632f5e01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:582e3315-7c6d-5486-98a3-61f7f2b4d746", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6fda907b-ec14-59f4-ac02-dad81408466d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5bd034b8-42b5-5177-9154-dd1fff50f1d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:da8edde9-7e05-53b0-9fb2-443aa5dfe668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b686d8cf-675b-5181-aece-c34a24d8f219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:fd0bb879-1cff-5139-9fb5-3f3c58a412f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4739b4ab-9b5b-517c-aeb2-e3f93a0ed40f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:101060bf-4f67-5fd2-906f-54e5fbd9f4cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bb1982ea-b501-5a1b-8739-532aedf8311c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5b9b2944-9c2b-564f-8fa9-bce5cfea7ee7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8eb6d66b-5562-5ee8-a784-af41985e52b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1aa0137f-912a-5b9d-9eaf-5a58ca5a0367", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f497e19d-d601-5d98-a0ca-8e22380f8e19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:58c4713a-6891-5801-b784-d8bb39f1b0da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c2af37bb-7ec8-59f2-93e1-76db30211b20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4d04719b-f819-50d4-89c9-3da879646e57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9767b503-5c61-53ff-b712-63dcb8f472e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:34ec2c7c-82cd-5382-83ec-ad3274417132", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:398a87b8-149c-5ec3-bd09-de48354bdf2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8a19412b-387f-521c-984b-4628bb4d709a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e634683a-6865-5a5a-bd33-be13519a49bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:708c5127-93d6-5d97-bc37-3cefc003e805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6267c5bf-4ba2-5b43-a847-4e187fa8cd44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1c29afd4-7a0b-5e27-b304-bc0ded87f2f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.27-tuxcare.10" } ] }