{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af8f1a79-d250-59da-8963-d73c1a88de01", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3", "version": "5.3.23-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.23", "type": "library", "group": "org.springframework", "version": "5.3.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:6438bcc0-7aa1-57a6-80e6-dfc97ff144bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 XXE vulnerability is NOT present in Spring Framework 5.3.23. The upstream vendor fix (commit 2ae6a6a3 by Rossen Stoyanchev at Pivotal) was already included in the upstream release before TuxCare's maintenance began. The SourceHttpMessageConverter class has all required XXE protections: processExternalEntities defaults to false, external-general-entities features are disabled in Do...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:fe624f6f-ffee-53a2-9324-8b32db03600b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.23 is NOT affected by CVE-2013-6430. The vulnerability was fixed in Spring Framework 3.2.2 (released February 2013) by upstream commit f5c9fe69a44, which added proper escaping for angle brackets (<, >), Unicode line separator (\\u2028), and Unicode paragraph separator (\\u2029) in JavaScriptUtils.javaScriptEscape(). The target version 5.3.23 includes this fix as pa...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:ea7f6493-a029-5fcf-b397-4e266d249908", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is NOT present in Spring Framework 5.3.23. The vulnerability was fixed by the upstream Spring project in June 2015 (commit d79ec68db4 by Rossen Stoyanchev) and included in Spring Framework 4.2.0+. The target version 5.3.23 (released in 2022) already contains this upstream fix. All XML parsers now have DTD processing disabled by default via the `disallow-doctype-decl` feature, prev...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:138dd317-ae88-5a43-82e4-626672dadbba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.23-tuxcare.3 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:47523766-96c6-501b-b7e5-47042392beca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 5.3.23-tuxcare.4. The vulnerability allowed HiddenHttpMethodFilter to accept any HTTP method (including TRACE), enabling XST attacks when combined with XSS. The upstream fix restricting allowed methods to PUT, DELETE, and PATCH was already present in the Spring Framework 5.3.23 release that TuxCare onboarded. Both Servlet and Reactive variants c...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:c4ddb45b-bbf1-5636-a272-166fe807b809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. CVE-2021-22118 is NOT present in Spring Framework 5.3.23. The vulnerability involved predictable temporary directory paths that allowed local privilege escalation attacks. The target contains the upstream fix (introduced in 5.3.7) that uses Files.createTempDirectory() to generate random, unpredictable directory names for multipart file uploads. Both affected multipart readers (SynchronossPartHttpMessageReader and DefaultPartHttpMessageReader via FileStorage) implement the random directory defense. The fix was authored by upstream Spring developer Arjen Poutsma and shipped in the upstream 5.3.23 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:021dca02-dcfb-5960-b6a2-4b25f533de38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.23-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.23-tuxcare.4." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:8ccf07a1-74c5-5510-b6e6-c39e1256c6ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.23-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.23-tuxcare.4." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:a41ea6d5-6da1-5c2e-9fc6-9335c7c8ef26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.23-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.23-tuxcare.4." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:7830ec8f-65da-5240-b798-1f1f24fa8fe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.23-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.23-tuxcare.4." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:0bb86f65-503d-52b2-ac1c-bfacac44bcec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.23-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:127305f4-b703-5a1c-83d9-c248c3e21021", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2025-41234. The vulnerability requires quoted-printable encoding of the filename= parameter when using non-ASCII charset, which was added to Spring Framework in commit 58fbf60d2d on Feb 1, 2023 (5 months after v5.3.23 release on Sep 15, 2022). Version 5.3.23 uses a simpler architecture: when non-ASCII charset is specified, it outputs only filename*...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:a2e8e371-21b6-5456-9aa7-a2890146c269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.23-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:63abf2b4-f52e-5a34-872d-d441afdaa87e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.23-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:66cbcaab-9990-5536-9410-9cc282602352", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2026-47885. The vulnerability concerns PartEventHttpMessageReader failing to enforce maxPartSize limits when maxInMemorySize is set to -1. However, PartEventHttpMessageReader, the PartEvent API, and the maxPartSize configuration were all introduced in Spring Framework 6.0 (February 2022) and do not exist in version 5.3.23. The target version uses D...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:e3c07cb5-e0c9-5d9c-9d1b-455039185225", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.23-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.23-tuxcare.3 does not contain the vulnerable Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java). The CVE-2026-47889 vulnerability is specific to the Jetty 12 Core adapter's getSameSite() method returning null. This version uses a servlet-based Jetty adapter (JettyHttpHandlerAdapter extending ServletServerHttpResponse) which properly serializes the ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:e3b4e87a-9c30-5c23-9347-451801b103db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.23-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ], "bom-ref": "urn:uuid:738efce4-6cfb-5d37-898f-3bbe596a14a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.23-tuxcare.3 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.3" } ] }