{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a3daf551-b84e-556f-b97e-bd8da1b6cbd9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15", "type": "library", "group": "org.springframework", "name": "spring-r2dbc", "version": "5.3.39-tuxcare.15", "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:41511eb0-383f-54e1-87e3-7810da775ae4", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:7c53e267-07c0-588a-8c83-a26bbfc2d8e4", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:b241bfa5-dc23-52b0-bf7d-b862c8b250ce", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:f94a5ed7-0331-5f7d-9fd6-729a24d6bf75", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:6cb1283d-0787-5c69-8f38-d6e56794c524", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c0d3bd78-2590-5fa4-bd14-72b25289f2ba", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:d5ccadf0-68f1-53a4-8ee5-c7c398c13b10", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:fff82687-fa52-525f-94e0-01456a57363e", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-r2dbc 5.3.39-tuxcare.15." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:b0b9e4d8-b4a9-56d0-a612-4e322c989282", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:cfabe188-dd0d-589f-bf4b-dc70cc17bd02", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:13200025-edd5-514a-b01f-4e166e0eb819", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:5656e2df-d4cf-569d-adc5-2acd1b5f5b01", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:fb67d73e-d866-5b4d-9bd3-da001f6b15a3", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:5903ed41-1500-5a87-8c10-7d3955f93a4e", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:d550c143-522e-5f84-ad0d-3f3f0b594b9e", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:779138ac-627c-5549-bf27-42ea4b12a21b", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:1110fd2a-9e50-56fe-a169-b8516dabb72f", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:06449c7e-ee62-5e38-902b-507cd065cbc8", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:97a3c889-c5ae-5ec1-a6bc-e997950143ce", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:bfd4d586-6c9b-5e18-b6f1-9f3f21f9926d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c5b44f89-1e9f-519c-aa14-92cf7ed9a113", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:8759c686-2b1a-5c58-8088-22cde1b314c5", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:46e6fb3b-2fbd-5450-884b-d768ac8621af", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:c5bf1a1c-7e04-56e7-b384-09bf3b46f66c", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:73eb1964-1901-5a51-bb35-5957c246f418", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:08ec656e-d081-5175-9616-897298dbf24b", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:82cdd3e8-0394-5e2b-a19f-6e46f30f18d8", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:566c2728-6968-5d66-97cf-e720363ee220", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:17fc636f-a8a0-5ab5-96c5-5da9ec64b374", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:53dbe264-d58d-5c42-ad57-433eac0e5f08", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:15098d6a-7f21-50e4-9c9f-24a029071c3d", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:86ac9c9d-fd80-56b7-92b8-18ed3178d148", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4e06a1a4-1c52-5a40-8b6d-0952eb07aabd", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.39-tuxcare.15 of org.springframework:spring-r2dbc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.39-tuxcare.15" } ] }