{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:46472e53-4238-5244-a0f5-f13a8c3c9534", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9", "type": "library", "group": "org.springframework", "name": "spring-webflux", "version": "5.3.37-tuxcare.9", "purl": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:75a64011-bc8d-5fd8-bb26-5d2f0972672f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b15dfc90-191b-5065-a2c9-ee659d19d5e8", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8aceba09-b3b4-560d-ad46-d7a90ae94619", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:be1a81cb-f0d5-5421-9c83-413a5d9b4a96", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b8a09d24-6d96-5db8-97fd-f4020d767b89", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:56593df0-9d8b-5423-84f2-7afd767c2d7e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1e8ea746-9a21-5a25-974c-000f2d43246f", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:52db6066-231b-5cf9-968b-d9d4ac1c604f", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6cb5d3ce-2ac4-578d-a54e-b82e2eb2051e", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2684e925-d012-5993-a717-923d69dace04", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:480d6064-fdca-5a9b-aa62-25d1aa00685a", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3683822e-5431-51c4-94e5-830eddebd9e7", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a29a65da-8f2e-5ee1-8a84-b66943beff58", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c7f25a46-9591-5ade-af87-cda8ce7b28de", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:22fd46d1-9b46-500b-9f70-3d0b23dedfc3", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c56e897e-2a78-5e49-8985-938d966b7c82", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:65635a21-9455-5c57-bf2a-60b77036f87c", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b93d7813-3157-5cb4-9617-4bbab46ae617", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0bf993cf-4dba-5762-b05f-d8b364c8c50c", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-webflux. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:20bc9e3c-77a2-5eac-b05d-ff5c12f37831", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:30a02196-68fd-58e8-aa9d-00d285638490", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1d1ab027-1941-5fbd-812a-2a48edac0297", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:27b8a2ab-012e-5598-8297-190676847e56", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6ed59226-0515-5fd1-99fe-fb879c5736fe", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:180e2fc3-f29f-5c38-9fb4-c44781ef3841", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0816a36f-e3a1-5ed5-a121-0d62d8870b25", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:81265393-1884-5431-906f-a458140334b8", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2c178d49-b436-5f26-ad97-852baed447a8", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-webflux. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3410652c-6b50-52a6-948b-01c9fbb363a5", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:15c6f105-b95b-56d8-aad4-36211dc8302f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ef6484cf-ece6-5089-8ec4-6210dfecd1ec", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:25ae1516-2f1e-5c30-994d-a60ac3d1a1ad", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:161a55f4-7311-56ab-a545-bff631865f79", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d5b2370c-65ed-51e7-9908-7632c514b9ed", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b7a21414-047e-5dcd-8d9c-55729ccf94e1", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1fbe37f0-414d-59e7-9495-c6ad43f41641", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ed0f4c23-7f80-5d94-a2f3-4dcfe67d2bb7", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b1428ddd-50bd-57db-993e-0be15e6965f2", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:086cb9ae-888b-5512-aa0d-1ef7d2f46a48", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:875ef946-0c61-58a5-a4aa-72aebcce180f", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5ed27509-6808-50df-9488-1d83565dfa74", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:07254618-082f-52f2-bbba-b66e8ad93b65", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:bfdfd218-c6c9-541b-bb81-aaba6da31de1", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e236818e-5666-5d85-924c-bc5959760c8f", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3c074e3c-ab22-5ef0-b155-2268589873eb", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6fe3c010-723d-5beb-a5b1-8a07ffa9b2d8", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2f520425-0fa8-5105-a51b-35d876aaa9dc", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.9 of org.springframework:spring-webflux." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webflux@5.3.37-tuxcare.9" } ] }