{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e9338b43-0057-51ce-a8a4-83b10bda56e2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:03e133ef-2fa2-53c5-ace8-7ebb723a3b78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 affects Spring Framework versions before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1. The target is version 6.1.15-tuxcare.6, released in 2024, which is far newer than the affected versions. The XXE vulnerability fix (commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a by Rossen Stoyanchev) was applied to the upstream Spring Framework in November 2013 and shipped with all subsequent releases...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:044ab6ff-5c5c-5a04-a684-4bc4b5448dd3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 6.1.15-tuxcare.6. The vulnerability required missing escapes for four special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape() that could enable XSS attacks. The target contains all required escapes (lines 79-92 of JavaScriptUtils.java), introduced by upstream commit f5c9fe69a4 in February 2013 by Rossen Stoyanchev. This fi...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:af4ea4bf-f7b7-5f1f-a537-8d4ab76a51b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is NOT present in spring-framework 6.1.15. The vulnerability affected versions before 3.2.14 and 4.x before 4.1.7. Version 6.1.15 is far beyond these affected versions and ships with the upstream vendor's fix from 2015. The fix (commit d79ec68db40 by Rossen Stoyanchev from Pivotal) disables DTD processing by default across all XML parsers, preventing the memory exhaustion attack. ...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:dff63811-f0d8-55ee-a89a-ea4108b8b3a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. The target Spring Framework 6.1.15-tuxcare.6 is NOT AFFECTED by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) that performed unsafe Java deserialization were completely removed from Spring Framework in version 6.0.0 (upstream commit 5822f1bf85 \"Drop RPC-style remoting\" by Juergen Hoeller). The target version 6.1.15 was onboarded with this removal already in place. No HTTP Invoker files exist in the repository, and no java.io.ObjectInputStream usage was found in the spring-web module. The only deserialization present uses JSON (Jackson) and Protobuf formats, which are not vulnerable to this CVE's Java object deserialization attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c16dc97b-00ef-548b-bef5-66722496fd74", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 6.1.15-tuxcare.6. The vulnerability (arbitrary HTTP method override via HiddenHttpMethodFilter allowing TRACE for XST attacks) was fixed by upstream Spring maintainer Brian Clozel in May 2018 (commits f64fa3dea1 and a5cd01a4c8). Both Servlet and Reactive filter variants contain the ALLOWED_METHODS whitelist (PUT, DELETE, PATCH only) that blocks ...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6b7623a9-e3a9-5db5-bfaf-6586f67d37bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.1.15 is not affected by CVE-2021-22118. The vulnerability affects predictable temporary directory usage in multipart file uploads (5.2.x < 5.2.15 and 5.3.x < 5.3.7). The fixes (commits cce60c479c and 0d0d75e253) that introduce random temp directories using Files.createTempDirectory() were already included in the upstream Spring Framework 6.1.15 release, not applied as TuxCare backports. The vulnerable code pattern (predictable shared directory paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d13fdeb2-98db-58b3-8c92-05c75e78e29b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. CVE-2024-22243 fix was already present in upstream Spring Framework 6.1.15 before TuxCare onboarded the version. The vulnerable USERINFO_PATTERN `([^@\\\\[/?#]*)` was fixed by upstream commit 120ea0a51c (Feb 9, 2024) which removed `\\\\[` from the exclusion set. A later upstream commit 494ed4e852 (Apr 11, 2024) further refined the pattern to `([^/?#\\\\\\\\]*)` for RFC 3986 compliance, which maintains the fix by allowing `[` in userinfo. The current pattern correctly parses URLs like `http://[evil.com@trusted.com` with userinfo=`[evil.com` and host=`trusted.com`, preventing validation bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cc9a6ec2-e917-5025-a41e-c69560e74ffe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. The target Spring Framework 6.1.15 is NOT AFFECTED by CVE-2024-22259. The upstream fix (commit 381f790329) that adds IPv6 host validation to prevent open redirect/SSRF attacks was already present in the upstream 6.1.15 release before TuxCare onboarding. The vulnerable pattern (missing validation for malformed IPv6 bracket notation in URLs) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9626b33f-3c1c-5bfa-84c9-7fc8b057925e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. CVE-2024-22262: Target spring-framework 6.1.15-tuxcare.6 is NOT AFFECTED. The vulnerability in UriComponentsBuilder URL parsing (allowing backslashes in scheme/userinfo/host/port to bypass validation) was fixed by upstream Spring in commit 494ed4e852 (2024-04-11) and shipped in upstream v6.1.15 (2024-11-14). TuxCare onboarded the already-fixed upstream release (2026-07-26). All four vulnerable regex patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) correctly exclude backslashes at HEAD. No TuxCare backport needed for 6.1.15 (backports only applied to older versions 4.x, 5.x, 6.0.x that lacked the upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:05f8cf4c-6033-5f31-8206-d0b9115c27e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Target version 6.1.15 is NOT affected by CVE-2024-38809. The vulnerable regex-based ETag parser that could cause ReDoS (Regular Expression Denial of Service) has been completely replaced with a safe state-machine parser. The fix (commit bb17ad8314 \"Efficient ETag parsing\") was authored by upstream Spring Framework (rossen.stoyanchev@broadcom.com) and shipped in the upstream 6.1.15 release befor...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:092bce0b-d242-5e25-a2f8-df965411ff3a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.15 upstream release already contained the fix for CVE-2024-38820 (commit 23656aebc6 by Rossen Stoyanchev, using Locale.ROOT for case conversion). TuxCare onboarded this already-fixed version. The vulnerable pattern (String.toLowerCase() without explicit Locale, causing Turkish-I and similar locale-dependent mismatches in disallowed field protection) was never present in the...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a8c66da1-4aa8-565c-9650-caeb7806dcf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:929f93e1-4c7b-5c28-9117-a778c87a6fc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3f8e4f70-39e4-5a03-b6b8-6ba9ee5afa9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2102f0cd-780d-56e7-bdfd-e0170e755153", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cc6ee7a8-b5d5-5e79-9dd2-b176979cd56d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2026-47889 affects the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse) which was introduced in Spring Framework version 6.2.0 on January 15, 2024. Version 6.1.15 does not contain this adapter. The target only has the servlet-based Jetty adapter (Jetty12ServerHttpResponse extending ServletServerHttpResponse), which properly handles the sameSite cookie attribute at ServletServerH...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cf76a86b-1334-5e4a-8377-202860e7dd02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b56bef34-4e8a-5905-8969-5aa7e2fd3947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.15-tuxcare.6" } ] }