{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5029ed38-c1c5-552c-a630-f6a73d81606c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6661bb90-b119-591f-a4fb-fdda1be3fdbd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.0.16 is not affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed by upstream commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a (author: rstoyanchev@gopivotal.com), which was already present in the upstream release that TuxCare onboarded. The fix disables external entity processing by default in all three XML parser types (DOM, SAX,...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3e05392e-c2b5-5d39-8f64-7e76738748af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 6.0.16-tuxcare.11. The vulnerability required missing escape sequences for angle brackets (<, >) and Unicode line/paragraph separators (\\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The target code contains all four required escapes (lines 79-92 of JavaScriptUtils.java), matching the vendor fix exactly. This fix was authored by rstoyanch...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8642a71c-3a51-52db-b907-d4a3c4bd662b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192: Spring Framework 6.0.16 is not affected. The upstream fix for DTD-based XML bomb DoS vulnerability (commit d79ec68db4 by Rossen Stoyanchev) was shipped in Spring Framework v4.2.0.RC2 (June 2015) and is included in the v6.0.16 upstream release that TuxCare onboarded. The defense code disables DTD processing by default across all XML parsing entry points (spring-web converters and ...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1a50b6c7-0f03-59e8-b952-041794c25340", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. Spring Framework 6.0.16 is not affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) that enabled unsafe Java deserialization were completely removed by upstream Spring in version 6.0.0 (commit 5822f1bf85, September 2021). This removal was part of the upstream release that TuxCare onboarded, not a TuxCare-specific backport. The target version 6.0.16 inherits this removal from the upstream 6.0.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2f6af854-62bc-5c89-8642-8cb064e400d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2018-11039. The vulnerability allowed arbitrary HTTP methods (including TRACE) via the HiddenHttpMethodFilter's _method parameter, enabling XST attacks when combined with XSS. The upstream fix was committed in May 2018 by Brian Clozel (bclozel@pivotal.io) and restricts allowed methods to PUT, DELETE, and PATCH only. This fix was already present in ...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:81a4009f-da37-5ae3-a100-7e61195e3f9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. Spring Framework 6.0.16 is not affected by CVE-2021-22118. The vulnerability affects versions 5.2.x < 5.2.15 and 5.3.x < 5.3.7, which used predictable temporary directory paths for multipart file uploads. Version 6.0.16 includes upstream fixes (commits cce60c479c and 0d0d75e25 by Arjen Poutsma) that were shipped in the original Spring Framework 6.0.0 release before TuxCare onboarding. The fix uses Files.createTempDirectory() with random suffixes to create unpredictable temporary directories, preventing attackers from pre-creating or manipulating the storage location to read/modify uploaded files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2bdfa902-491c-5d08-8f16-bb2377a949d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:89bc796c-c374-5241-a13f-6a62aaa287c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cbcc8ff3-56bb-51f0-906a-761fe978ba71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:04ac500e-b177-53bc-923c-61edf08d0ef3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f836e9ea-ca75-592b-93ab-5e3cd2880785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:12a0fc20-3234-5e19-94af-298ed7dc2460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ce1163fb-6da1-5180-815e-48e69a3e95fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:440162dd-2107-5339-b966-d1a70892b301", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2cd38595-327f-571a-bf8a-fcac00eae562", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Version 6.0.16 is not affected by CVE-2026-47885. The vulnerability concerns a bug in the maxPartSize enforcement logic when maxInMemorySize is set to -1. However, the maxPartSize feature itself was introduced in Spring Framework 6.1.0 (commit 66aac7e359, October 25, 2023) and is not present in version 6.0.16. Without the maxPartSize feature, the specific vulnerable code pattern described in th...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fa215c69-8111-594e-9112-c848d6174135", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework version 6.0.16-tuxcare.11 is NOT affected by CVE-2026-47889. The vulnerability exists in the JettyCoreServerHttpResponse class, which is part of the Jetty 12 Core reactive adapter. This adapter was introduced in Spring Framework 6.2.x (commit 0a60c622cc, January 2024) and is NOT present in version 6.0.16. The target version only contains servlet-based Jetty adapters (Jetty11Ser...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fd35c719-7199-5fec-8db0-319810c09a47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2e191afd-06e6-5719-ae45-1d2b9bc58af5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.16-tuxcare.10" } ] }