{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b23ee9b6-fe63-5d06-b55c-431948f5f6a0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-webflux", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3d21fca7-0ad3-55e8-95af-ff4844801a97", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e1e14174-5927-5df9-8e14-01b03c179b29", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c1274fdf-7059-5831-bfa5-9ae1838a22ae", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:18d53b03-c602-5dad-9025-d1cbd1acdac3", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b7f66c62-117d-57bc-bb2b-efcdd25f131f", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ac88d7d5-47ea-5ec2-a641-2ed602e8ae99", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c621179f-0ce3-5786-b4b4-ed0278f69400", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c7bb9233-625c-5581-96a0-fbcc986a4dd3", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7bf3f45c-7e48-5f04-b32d-e0fc4feda039", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:10510c6b-bb4f-583c-8e34-515da35e3a60", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:37d75ce5-4daa-5c80-a415-577ab1f5af2a", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:42c62975-4e35-5c0e-994c-bf13057011df", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d0878fb1-2dca-5c8a-b773-ca26d1f3db6c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:aa9fabb8-1aba-55d5-8d26-636696cd2242", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e8a48a9e-7ba6-5d70-9e15-b7594ddbf197", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b536b18c-3ee5-5a20-b875-9a1dc1372393", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b5dbc330-2bd6-5f40-8b11-13e78706218a", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1d271404-0af0-548d-a024-ca549fe8fdba", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3e036672-4f16-5b3f-93fb-13955abb19db", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:aec2988c-bec7-5bac-8710-c920f9356480", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:41f3cea0-0e1c-5789-9b99-5ce250802f02", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:afdcd75e-4640-5bd8-8f0c-2e41ffcf0f1b", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c9a9d0dd-4396-55ef-93f6-c447c7ab4b2e", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9b335d4d-ad9e-5405-9442-aed26d295078", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a8b0a76c-baa5-5666-9587-7ef664dc0fe4", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dd7500c3-81e7-5c1a-a742-f011ad500e53", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4f6a6960-d4a6-599e-bbec-457fbfa97137", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fbe68389-c122-5c4a-9b40-a9f3bd6e3e66", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:99612790-45cf-52bc-8bc1-a136031927fe", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0ca895c6-4339-5f85-8ac7-7d68a526e0a5", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:421e4c94-aeeb-5294-8a14-d577a8cd1632", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:58a295a5-d12c-5da9-a5d2-69a51ece428e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2be861c0-5351-5768-b142-603a52df14fa", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ffeca20b-340d-5de5-ac76-fba3d2b514d4", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:85de8322-9df1-5b35-be69-de763fcb99e4", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fc225b31-df84-5433-8c3d-acb5057b9786", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b7bff26a-2cfc-5c8f-b553-9f0e91afe3e3", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:89bb0390-f915-5c3c-8a8f-8e56719724de", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:58368a0b-8dcf-5dac-a237-280f30317757", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8b4264ac-803f-5b01-8647-6fba772b5127", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dab5f61b-a183-574c-81bc-f31e8f645566", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e08fc1a6-21b5-52c6-8bfc-8b3cac6bd429", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f6ff428f-6217-54d5-9ac7-d73656d7b4f9", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.2.13.RELEASE-tuxcare.6" } ] }