{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e533e2e-cc59-5057-a335-4a0b3c1bbf55", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2", "version": "5.2.11.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.11.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a75001a4-79eb-56c3-b9b1-d8c68c76d43c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 is NOT present in Spring Framework 5.2.11.RELEASE. The XXE vulnerability in SourceHttpMessageConverter was fixed by upstream Spring Framework in November 2013 (commit 2ae6a6a341). The target version 5.2.11.RELEASE (released October 2020) shipped with this fix already in place. The code shows processExternalEntities defaults to false, and all XML parsers (DOM, SAX, StAX) have exter...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:caca953e-2c2e-5c98-a395-381ffa997f42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.2.11.RELEASE is NOT AFFECTED by CVE-2013-6430. The vulnerability pattern (missing escape sequences for angle brackets and Unicode line/paragraph separators in JavaScriptUtils.javaScriptEscape) is not present. The fix was authored by the upstream vendor (rstoyanchev@vmware.com) and shipped in the original 5.2.11.RELEASE before TuxCare onboarded it. All four dangerou...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:100cba2c-9e06-552d-aaaf-2608d69f058b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 does NOT affect Spring Framework 5.2.11.RELEASE. The vulnerability (DoS via inline DTD declarations) was fixed upstream in June 2015 by disabling DTD processing by default. This fix was first released in Spring Framework 4.2.0.RC2 and backported to 3.2.14 and 4.1.7. The target version 5.2.11.RELEASE (released November 2020, ~5 years after the fix) already contains the complete ups...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e709c45d-315e-5b11-a074-8d709ce7adf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ec13b31-412a-5329-8eed-77e6e9f1c2f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.2.11.RELEASE is not affected by CVE-2018-11039. The vulnerability allowed arbitrary HTTP method override via the HiddenHttpMethodFilter's _method parameter, enabling XST attacks when combined with XSS. However, the fix restricting allowed methods to PUT, DELETE, and PATCH was already present in the upstream 5.2.11.RELEASE before TuxCare onboarded it. Both servlet (...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:661b9315-ab1f-5be1-aaf2-26ab65ec86b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ace8571-8aaa-5551-9818-dda1e1dcf252", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 5.2.11.RELEASE-tuxcare.4." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7fe2688a-4be9-5052-a0e0-03f95d7bebc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0fde8930-002a-5632-b3b1-aacac2bc81dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9fed0994-c4b8-5e53-b425-e65bf8a458dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:407dcd05-44bb-50d5-8fb5-7630b74c60d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Target version 5.2.11.RELEASE does not contain the vulnerable code pattern from CVE-2024-38820. This CVE specifically concerns improper use of .toLowerCase() without Locale.ROOT in DataBinder's disallowedFields handling, which was introduced by the CVE-2022-22968 fix. The target version predates that fix and does not perform any case conversion in setDisallowedFields() or isAllowed() methods. T...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74e6034c-5114-53b1-936b-1f06d9d096a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.11.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2025-41234. The vulnerability exists in the Q-encoding (quoted-printable) feature introduced in Spring Framework 6.0.10+ (April 2023), where double-quotes in filenames are not properly marked as non-printable. Version 5.2.11 predates this feature and uses only RFC 5987 percent-encoding for non-ASCII filenames, which already encode...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:00be8a40-9fe9-5a49-be28-b719140bc9c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97f501e1-b6d0-5628-a2cf-5d85f40d65d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98db7a45-3c28-587f-9b9c-189b44f66699", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework version 5.2.11.RELEASE is not affected by CVE-2026-47885. The vulnerable component PartEventHttpMessageReader and the PartEvent API were introduced in Spring Framework 6.0.0, while the target version is 5.2.11.RELEASE. The code containing the vulnerability does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9ed89de-333f-58fc-80c8-2dca32cfa1c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.11.RELEASE is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse), which was introduced in Spring Framework 6.2.0-M5 (January 2024), four years after this release. The target version uses Jetty 9.4.31 with servlet-based integration (ServletServerHttpResponse), not the Jetty 12 Core API. All cookie...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ad5d4095-17c1-56d5-b21d-1e76eadc2794", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:761459d8-e798-59c4-9be1-6c99f60cba9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.11.RELEASE-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.11.RELEASE-tuxcare.2" } ] }