{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e206b0f-d0a4-55f0-bde4-114c0b35defd", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-webflux", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a66cd80f-ee50-5266-b51a-0133b7679518", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:492e85d5-bb4f-5d99-8073-aa1344b08b22", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:03db01ac-81ff-54d3-a98a-440558a357a2", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9ce60498-226a-56a6-a102-9e434fcc77f0", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:61fef30f-cdc0-53a1-b936-b32e4b8ea27d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0ba34bf4-46e0-504a-b047-74655c9bd646", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f40adc4-eb93-5e7f-8097-e2d60c1160c9", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5a4b85c3-daab-5d0e-9204-8c88c1fc5d2c", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:48f46380-12a6-5cf6-a11a-a9adbea39f37", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e37e2fff-b1e5-5842-b7a9-6c392de74ae9", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd8efa3a-b55e-5e59-a13e-ccf7ed453b3b", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:28f33fe7-1ed2-5ee8-bbb3-04b96e97f1bb", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ea514ccb-39a1-572d-bb8f-74510b2e2914", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be960567-589f-5866-bc90-e543dd503518", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4c672f99-9ce4-51c7-9fe2-07227745314f", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e637c31-1653-5919-9ae1-6a519b9bff15", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-webflux 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c504caf8-ac12-51f8-999a-906d2efa2757", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e00502e3-4b00-5965-9900-1d869b0806c6", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:88d9122c-b925-55be-8ecc-133cb97e8e07", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0c93c3e-ee53-5f56-a597-d30f13b3ec2f", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dd18883c-8184-50d8-bf3f-d805f71f5012", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:86b7d315-b282-5fe9-b4e5-1c644f5c7f13", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e47892b9-dccc-534d-86d0-0444724fd94e", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35ef8bec-8d1b-5b63-8b07-0dec85ecf650", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b60ac984-f586-5d2e-a437-fe4d50fe7e05", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5115e415-b2d4-5ae3-9d30-65238f67ae38", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:953f0c34-5419-5c80-9027-bb8a9bd96bca", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c007f3e9-fd75-5301-8c95-104d73ab0a2d", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:80416277-3e84-5a09-8c5d-4141c5686910", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d5d011db-15ee-5145-95cd-0050e8a5aa06", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1c3c4462-13ec-5a13-8bb1-b04afc47b8df", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:969743ea-e9aa-5932-86c7-813358e612c9", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:371883d7-63fc-556b-93b1-552a841f7c05", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6411ef80-9719-52c5-8dd5-009d552c3e91", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7726db84-2329-5cc4-b50b-cb406b8238e2", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee754f7d-1cf6-521c-86e3-9e3923a7b670", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:334d3a8e-d052-5425-867c-c64a078d01b5", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c5c29d4f-97d8-5d7f-b190-5e05ca4fae2f", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:68cf2f4a-270f-5eeb-8ec3-82c71fe7f668", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c70096f6-fac4-535c-a067-3e52de85afcc", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2c5d8fb7-cc49-5696-b514-7590f872dd96", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7d966eca-a493-5c73-b333-4ce56d056b76", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.1.20.RELEASE-tuxcare.3" } ] }