{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:73f51a76-9903-59b0-85bc-ad7ef70ee66b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-r2dbc", "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:206f1faf-1d97-52f4-9b17-bef1c37cb557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0f62931c-91cd-5a0d-9d6d-db23f14f6c83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ed79aadc-d17b-56f8-ba0f-eb748e5a24d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:46a35835-4b36-5247-9e26-be71f4005f05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a052289e-c474-5aa3-a15d-0225e217cc1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:45427a4e-3071-5258-9d0a-d98f83cc0e8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a215939c-5e92-5b23-ac53-6a6da591d2c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1a51bb91-e1b4-50e2-8a34-2bab2c0532ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:162f01a1-65bf-5e89-9310-6bc8cbf5cb9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:180228b7-03a8-5564-996d-76e5dfdad961", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:22168f7b-04f8-5d67-8dc3-bb41ac347443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f2ca44de-cff7-5722-af75-d655cd8ec2cf", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-r2dbc 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3b7d7b11-42b4-5c7d-8fec-46a1d5b1ff70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f739fd61-1b1d-53b3-801a-323bb36b56e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:10cbf038-a8cd-5810-bd9a-afe8c49452f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:07c24b4e-1626-525f-9695-d5434790507f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1eb530bf-31d8-5e14-b60f-e5c328c033e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dcefcfb4-b802-50bc-a64f-d596083f4a8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:403665ab-92c7-5039-a974-a935c6735429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a656cda3-b11b-507d-8e47-acc659a1f905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0c62800e-5314-58c4-8c1d-5169acf3e48b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8c7ca813-15bf-50d3-82fe-ad4070a5aba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:18e720a2-4613-56c6-a970-7a09360c0784", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b20b3c1b-3f8b-5839-bd65-565b8c77f355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2ba505df-02b3-5990-a63d-2768aef161e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:849af2ae-a6cd-549d-9479-6e1503aa0d45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:208b8610-cc7d-5461-8597-26117324b3b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bcd5b2cb-1734-53a2-839f-0c85b7dbeed2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:164cef78-5d7f-5f6a-94cd-3f002f2f7cf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ee0f1e1b-c80b-5eee-9809-2ca658860ab8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0f38cdc1-113a-59cc-8602-4b7f3b80fe2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:39ce958e-c146-515a-9579-4af8786074e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8673adf6-dba4-53f0-b5fc-87ef23765b6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2408cb32-28e9-5046-bb8b-efd14415a905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:907a6625-afb6-554c-9284-18331ecbd27f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bdae138d-2817-59b2-94ab-23931209bd62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:32acce71-f816-59f8-a386-b78f539aaa6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7204325a-c161-57f3-93a7-198057f6fbd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3d12651b-f51a-5460-a909-81afa70e90f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8215615d-9dfa-54f1-8ccd-6d74ced39b70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fb4ce679-0ef8-55fc-9c68-7fb104b1644a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:173ae752-79ab-5cd8-a06c-be55820e94b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5604004a-a543-5c45-af6b-750aee6fe85e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f3c6f2f2-ffeb-5c57-b83c-90aa435762bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:90425366-de1e-5f95-9311-05ff7457a766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0d14108f-320e-5a24-ab6e-7d388e48a6e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6f56a492-90b4-5946-8f5d-546859424181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:68e0cd75-f64b-5986-8d29-4b8298099f3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ca67394f-991d-5acc-b253-27bce819bfff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:621d1981-3c39-5916-a268-ead1f4db95d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3b456989-dee7-5be9-9f5e-282f461fbd28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-r2dbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.29-tuxcare.11" } ] }