{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f821016b-5084-54ae-acbe-a0817110bb6c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6", "version": "5.0.13.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1efd4790-f680-5ff1-8ceb-795c9c8ae3fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 (XXE in SourceHttpMessageConverter) is NOT present in Spring Framework 5.0.13.RELEASE. The vulnerability was fixed by upstream Spring Framework in November 2013 (commit 2ae6a6a3) and shipped in Spring Framework 3.2.5, 4.0.0.RC2, and all subsequent releases including 5.0.13.RELEASE. The target code contains the complete fix: processExternalEntities field defaults to false, and all ...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b63d3174-22ef-5c47-bab0-4c512cae848d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects Spring Framework before 3.2.2 due to improper escaping in JavaScriptUtils.javaScriptEscape(). The target version 5.0.13.RELEASE already contains the upstream fix (commit f5c9fe69a4 by rstoyanchev@vmware.com) that properly escapes the four vulnerable characters: left/right angle brackets (<, >) and Unicode line/paragraph separators (U+2028, U+2029). This fix was part of the...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:139dbc40-ba28-5116-9bd3-e43727d825d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper DTD processing causing DoS via memory exhaustion. The target version 5.0.13.RELEASE contains the upstream fix that was introduced in Spring Framework 4.2.0.RC2 (commit d79ec68db40c381b8e205af52748ebd3163ee33b by Rossen Stoyanchev). The fix adds a `supportDtd` flag (defaults to false) and configure...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3d6c497a-9a7d-553c-aea3-f4a39caf4729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d9f8f084-34f5-57a9-b13c-fb8684816ea2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.0.13.RELEASE is not vulnerable to CVE-2018-11039. The upstream Spring Framework team fixed this vulnerability (restricting HiddenHttpMethodFilter to only allow PUT, DELETE, and PATCH methods) before releasing version 5.0.13.RELEASE. Both fix commits (f2694a8ed9 for servlet variant and dac97f1b7d for reactive variant, authored by Brian Clozel on May 18, 2018) are an...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:812e8c10-060f-559b-aba0-62d4f57612c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:98ecbeaa-1606-5aba-a61c-d39c22647bc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:45b27bea-462b-5ef8-956f-e216945d568d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:70589446-710c-5a7f-9e5e-591557d17889", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:96961bdb-7578-5a71-82c0-7284583df128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e58c147f-826b-5aa2-9e9c-2942d9ce0199", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f6013faf-4226-5a09-8754-eaa12f485677", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.0.13.RELEASE is not affected by CVE-2025-41234. The vulnerability exists in the quoted-printable encoding mechanism (PRINTABLE BitSet + encodeQuotedPrintableFilename) that was introduced in version 6.0.5 (February 2023, commit 58fbf60d2d). Version 5.0.13 predates this feature by approximately 5 years and uses a different, secure architecture: for non-ASCII charsets, it genera...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:533c7053-313a-5acb-abf5-c7e863c66f11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1b24b64c-57b9-5a0b-b4d8-2aab4dba7156", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4975ee78-6491-5aa0-9dc3-023a5a628ada", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.0.13.RELEASE is not affected by CVE-2026-47885. The vulnerable component `PartEventHttpMessageReader` was introduced in Spring Framework 6.0.0 (April 2022), which is significantly later than version 5.0.13.RELEASE. This version uses `SynchronossPartHttpMessageReader` for multipart handling, which does not have the vulnerable code path. The PartEvent API and associated reader ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e3e50e4f-ee3d-5d19-ab6c-cd108f476065", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring 5.0.13.RELEASE is not affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring 6.x. Spring 5.0.13 uses Jetty 9.4.15 with servlet-based adapters and does not have the vulnerable component. Additionally, Spring 5.0.13's ResponseCookie API lacks sameSite support entirely (no field, no m...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0b898715-a1d0-50fd-a4c8-b2905fbacdda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fa088bf6-107e-5668-b8c4-e0de391b234f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.0.13.RELEASE-tuxcare.6" } ] }