{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:35cad8f1-3017-54ad-96c1-6222fd02b32c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5412fe12-e59a-596a-bb5b-25902e5c49ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.0.11 is not affected by CVE-2013-6429 (XXE vulnerability in SourceHttpMessageConverter). The fix was already present in the upstream Spring Framework 6.0.11 release before TuxCare onboarded it. The code contains comprehensive XXE protections: processExternalEntities field (default false), parser features that disable external entity resolution, and NO_OP_ENTITY_RES...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bde3d983-7614-592a-8afa-9e8aad6afec7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 does not affect Spring Framework 6.0.11. The vulnerability in JavaScriptUtils.javaScriptEscape that allowed XSS via unescaped angle brackets and Unicode line separators was fixed in upstream Spring Framework 3.2.2 (February 2013). The fix commit f5c9fe69a4 that adds proper escaping for '<', '>', '\\u2028', and '\\u2029' characters was already present in the Spring Framework 6.0.11 u...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:763b8976-e412-51aa-99fb-5b9a2e72e2a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is NOT present in Spring Framework 6.0.11. The vulnerability (XML entity expansion attacks via inline DTD declarations) was fixed in the upstream Spring Framework release by disabling DTD parsing by default. The fix commit d79ec68db4 (authored by rstoyanchev@pivotal.io) shipped in the upstream 6.0.11 release, predating TuxCare's onboarding. All XML parsers (Jaxb2Marshaller, Abstra...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6444f1c3-2f0b-5e16-93ab-731e752fbfd4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. The target Spring Framework 6.0.11 is NOT AFFECTED by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) that performed unsafe Java deserialization were completely removed by upstream Spring Framework in version 6.0.0 (commit 5822f1bf85 \"Drop RPC-style remoting\" by Juergen Hoeller). This removal was already present in the upstream v6.0.11 release that TuxCare onboarded. The entire org.springframework.remoting.httpinvoker package is absent from the codebase, making the attack vector (remote code execution via malicious serialized objects over HTTP Invoker endpoints) impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:316a965d-24a4-5a7d-a001-454dc6975ef6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 6.0.11-tuxcare.7. Both HiddenHttpMethodFilter implementations (servlet and reactive variants) contain the fix that restricts HTTP method override to PUT, DELETE, and PATCH only. The fix was authored by Brian Clozel (bclozel@pivotal.io) on 2018-06-11 and shipped in the upstream Spring Framework release before TuxCare onboarded version 6.0.11 on 2...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7c622608-1aa2-5ddd-b3e1-d7238635f2ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.0.11 is not affected by CVE-2021-22118. The vulnerability involved predictable temporary directory paths for multipart file uploads, allowing privilege escalation. The upstream fix (commit 0d0d75e253) introduced random temporary directories via Files.createTempDirectory() in the FileStorage class, which was already present in the upstream 6.0.11 release that TuxCare onboarded. The target uses DefaultPartHttpMessageReader with FileStorage.tempDirectory() that creates random temp directories with prefix \"spring-multipart-\". SynchronossPartHttpMessageReader, which was also patched in Spring 5.x, does not exist in Spring Framework 6.x. The vulnerable pattern (predictable temp directory path) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:744212d1-dda3-569a-b38e-5a7b51a8bec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:91267c6a-1fbd-5d5a-b986-3ea995bb4a04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web, and is fixed in 6.0.11-tuxcare.8." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:16db9af8-6a2e-5001-854c-da25a02600b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8fbe1260-aba1-56b1-a04d-a50df060ac0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:95b35d54-1f0a-5291-aefb-ed1f369e7aa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-web, and is fixed in 6.0.11-tuxcare.8." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2af13513-63e3-5586-9a3a-a7866e450c05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5de9d7f8-e727-5e9a-bfee-8fa3ef09a55a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d0afa536-9e04-513a-96b1-7d1fe8cd58c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5b50cc1a-9941-5319-9892-1c7a15d632e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.11-tuxcare.6 is NOT affected by CVE-2026-47885. The vulnerability concerns a bug where maxPartSize limits are not enforced when maxInMemorySize=-1 in PartEventHttpMessageReader. However, the maxPartSize field was introduced in Spring Framework 6.1.0 (commit 66aac7e359, October 2023) and does not exist in version 6.0.11. Since the vulnerable code pattern (maxPartSize bypass)...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d7442b7b-2f94-5f19-b294-8ae8cdd2c3f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.11 does not contain the vulnerable JettyCoreServerHttpResponse class. Jetty 12 Core reactive adapter support was introduced 7 months after the 6.0.11 release (January 2024 vs July 2023) in version 6.2.0-M5. Version 6.0.11 only supports servlet-based Jetty adapters (Jetty 11 and Jetty 12 EE10), which use ResponseCookie.toString() for cookie serialization and properly include...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2025d81c-c583-594a-b0cb-78b249ea5dea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bfe21109-21a1-58cc-9726-476a0a832b67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.11-tuxcare.6" } ] }