{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:459dd877-3c85-5339-8529-509720cec028", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11", "version": "6.1.20-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.20", "type": "library", "group": "org.springframework", "version": "6.1.20" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:0fdc470b-4696-5311-91e2-6ad454fe8ba9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.20 is not affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed in upstream commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a (authored by rstoyanchev@gopivotal.com), which was already part of the Spring Framework 6.1.20 release before TuxCare onboarded it. The target code disables external entity resolution by default across all XML parser ...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:b39ddcc2-81b9-5f43-a078-658eb861ed81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.20 is NOT affected by CVE-2013-6430. The vulnerability in JavaScriptUtils.javaScriptEscape() was fixed in upstream Spring Framework version 3.2.2 (February 2013) by commit f5c9fe69a4, which added proper escaping for angle brackets (< >) and Unicode line/paragraph separators (U+2028, U+2029). Version 6.1.20, released over 11 years later, contains this upstream fix. The fix w...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:03716765-d0bd-54ef-8d9c-18de8bbe4dcc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Target Spring Framework 6.1.20 is not affected by CVE-2015-3192. The vulnerability (unbounded DTD entity expansion causing memory exhaustion via crafted XML) was fixed by upstream Spring Framework in June 2015 via commit d79ec68db40c381b8e205af52748ebd3163ee33b. This fix was already present in version 6.1.20 when TuxCare onboarded it in June 2025. All XML parsers in the target have DTD processi...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:ef652ee1-3c8c-556c-9715-c68319e4111a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. The target Spring Framework 6.1.20 is not affected by CVE-2016-1000027. The vulnerable HttpInvoker classes (HttpInvokerProxyFactoryBean, HttpInvokerServiceExporter, etc.) that performed unsafe Java deserialization of HTTP-delivered objects were completely removed by upstream in version 6.0.0 (commit 5822f1bf85). The target version inherits this removal from the upstream release. No HttpInvoker code or alternative unsafe deserialization remoting mechanisms exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:6f38cd16-58ff-5947-b6ec-9e5d4d258d6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.20-tuxcare.13 is NOT AFFECTED by CVE-2018-11039. Both HiddenHttpMethodFilter variants (Servlet and Reactive) contain the upstream vendor's fix that restricts HTTP method overrides to PUT, DELETE, and PATCH only, preventing arbitrary method changes including TRACE. The fix was authored by Brian Clozel (bclozel@pivotal.io) from Pivotal/VMware and shipped in the upstream Sprin...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:7af30fba-5ccc-5d28-a6e2-8a432e76ad19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. CVE-2021-22118 does not affect Spring Framework 6.1.20. The vulnerability involved predictable temp directory paths (e.g., /tmp/spring-multipart) that allowed locally authenticated attackers to recreate directories and access uploaded files. The upstream fix introduced FileStorage.java which uses Files.createTempDirectory() to create random, unpredictable temp directories. This fix was already present in the upstream Spring Framework 6.1.20 release before TuxCare onboarded it. The target code uses FileStorage.tempDirectory() which creates directories with random suffixes (e.g., /tmp/spring-multipart-abc123xyz), completely preventing the attack vector. Additionally, SynchronossPartHttpMessageReader (the other affected component) was removed in the Jakarta EE 9 migration and is not present in version 6.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:89fe90cc-496e-518b-a9dd-07e7c1c729f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. CVE-2024-22243 is NOT present in Spring Framework 6.1.20. The vulnerability involved incorrect regex parsing of the userinfo portion of URIs when the pattern excluded the '[' character, allowing host validation bypass. The fix (commit 120ea0a51c by rossen.stoyanchev@broadcom.com, Feb 9 2024) changed USERINFO_PATTERN from ([^@\\\\[/?#]*) to ([^@/?#]*), removing the '[' exclusion. This upstream fix was already present in the v6.1.20 release that TuxCare onboarded. The current HEAD pattern ([^/?#\\\\\\\\]*) evolved further through the new URL parser work but retains the fix\u2014no '[' exclusion. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:7b84be13-95c3-5327-813c-58dea305a5f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. CVE-2024-22259 was fixed in upstream Spring Framework 6.1.20 before TuxCare onboarded it. The vulnerable regex patterns (USERINFO_PATTERN with '@' and HOST_IPV4_PATTERN with '[') and missing validation are not present in the target. The target contains the complete fix including tightened regex patterns and the checkSchemeAndHost method with all required validations (HTTP requires host, IPv6 bracket pairing, IPv6 path check). Fix authored by upstream developer rossen.stoyanchev@broadcom.com (commit 381f790329) and shipped in the release 6.1.20 (commit 1f9c59b17b) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:cfdb86d8-0cb0-5add-8497-c19820911bf0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. Target spring-framework 6.1.20 is NOT AFFECTED by CVE-2024-22262. The vulnerability involves incorrect URI parsing when backslash characters are present in URL components (scheme, userinfo, host, port), allowing attackers to bypass host validation for open redirect/SSRF attacks. The upstream fix (commit 494ed4e852, April 2024) added backslash to regex exclusion patterns in UriComponentsBuilder, preventing misparse across backslash boundaries. This fix shipped in upstream release v6.1.20 (May 2025), over a year after the patch was committed. Target code at lines 76, 80, 82, 88 contains all four backslash exclusions, and these patterns are actively used in fromUriString() and fromHttpUrl() parsing methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:0f155d7e-156b-5dbb-bfeb-2b24c56575f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.1.20-tuxcare.13 is NOT affected by CVE-2024-38809. The vulnerability (regex-based ETag parsing causing DoS) was fixed in upstream Spring Framework 6.1.12. The fix commit (bb17ad8314) was authored by upstream developer rossen.stoyanchev@broadcom.com and was included in the upstream 6.1.12 release. Since the target version 6.1.20 is based on upstream 6.1.20, it inher...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:fdf58f2c-0b4b-538f-aae9-0390b59e9991", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 The target repository (Spring Framework 6.1.20) is NOT AFFECTED by CVE-2024-38820. The vulnerability involved locale-dependent case conversion in DataBinder's disallowedFields pattern matching, which could allow bypassing field access restrictions in certain locales (e.g., Turkish where 'I' converts to '\u0131' instead of 'i'). The upstream release 6.1.20 fixed this by refactoring to use locale-inde...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:fdc9b3a2-cfd1-5754-8dc2-6e1e4f18a100", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.20-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:501a33ff-0618-5d5c-8676-71eb5ba74d14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.20-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:01ad6699-17e7-5204-8812-6d427be0ac51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.20-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:59ce1c3d-1ab9-5505-9c3c-9e9a50521ecc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.20-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:6552d727-7273-5dda-bc78-5829e37e60b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.20 does not contain the vulnerable component targeted by CVE-2026-47889. The CVE specifically affects the \"Jetty 12 Core reactive adapter\" (JettyCoreServerHttpResponse class) which was introduced in Spring Framework 6.2.0 and does not exist in version 6.1.20. This version uses a Servlet-based Jetty adapter (Jetty12ServerHttpResponse extending ServletServerHttpResponse) that...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:b57208bf-1d35-53c7-b0bb-cb52e02269eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.20-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ], "bom-ref": "urn:uuid:136667f1-1cfb-5bb3-b930-a23c103a1beb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.20-tuxcare.11 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.20-tuxcare.11" } ] }