{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3ea924bd-6f31-585f-9dc8-7919fa1af87a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9", "version": "6.1.4-tuxcare.9", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:28c107ec-d773-51ed-bc94-f55b2a31d676", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed in the upstream release by commit 2ae6a6a3 (Nov 2013) authored by rstoyanchev@gopivotal.com. The fix disables external entity processing by default via the processExternalEntities flag (defaults to false) and sets appropriate XML parser security features. This fix was already p...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:ccad17ed-80b1-5e90-936d-14244ef991f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects Spring Framework versions before 3.2.2 due to improper escaping of special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The target version 6.1.4 is NOT AFFECTED because the upstream fix (commit f5c9fe69a4 from Feb 2013) is present in the code. Lines 79-92 of JavaScriptUtils.java properly escape all four vulnerable characters to their Unicode esc...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:caf4a020-f26a-5f3a-a52b-172527ed0c90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations, allowing memory exhaustion attacks. The target is Spring Framework 6.1.4-tuxcare.8, which already includes the upstream vendor fix from 2015. The fix (commit d79ec68db4) was authored by Pivotal developer Rossen Stoyanchev and shipped in the upstream release b...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:36e989a7-272c-5fdd-aa15-90cf2d1ece38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. Spring Framework 6.1.4 is not affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, etc.) were completely removed from Spring Framework in version 6.0.0 (commit 5822f1bf85, September 2021) by upstream. The target version 6.1.4 is after this removal, and the fix was already present in the upstream release that TuxCare onboarded. No vulnerable code exists in the repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:97857c8a-7669-5890-b37e-2be480d76fec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 concerns unrestricted HTTP method override in Spring Framework's HiddenHttpMethodFilter, allowing arbitrary methods including TRACE (enabling XST attacks when combined with XSS). The target repository spring-framework 6.1.4-tuxcare.9 contains the upstream vendor fix that restricts allowed methods to PUT, DELETE, and PATCH only. Both Servlet and Reactive variants of HiddenHttpMeth...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:3cd8f336-0b78-548a-9d6e-aa65a853019b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. The target Spring Framework 6.1.4-tuxcare.9 is not affected by CVE-2021-22118. The vulnerability pattern (using a predictable shared temporary directory for multipart file uploads) is not present because the upstream fix was already included in the 6.1.4 release. The fix introduced FileStorage.java which uses Files.createTempDirectory() to create unique random temporary directories, preventing the privilege escalation attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:35742c1d-fb3d-58e2-9853-e69afd332b89", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. CVE-2024-22243 fix was already included in upstream Spring Framework 6.1.4 release. The vulnerable USERINFO_PATTERN regex pattern that could lead to URL parsing errors and host validation bypass is not present in the target. The fix (commit 120ea0a51c by rossen.stoyanchev@broadcom.com, dated 2024-02-09) is contained in the v6.1.4 tag and was part of the upstream release when TuxCare onboarded this version on 2026-08-21. Additionally, TuxCare later applied CVE-2024-22259 fix (commit 25bddf7a03) which further hardened the URL parsing by removing additional characters from the pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:836e32b7-7df3-5b90-bb38-549d337179cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:e3a6b5ab-e100-54e2-9c9b-07b38e6c7daf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:2c6f3219-8d00-5afc-9fd8-29e047a7fa43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:dc5d50a5-21ec-53b6-af4a-0be98bb1c71c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:75b1520d-d2e6-55fe-9de8-b56b7e7bcd59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:8de4e8ac-0f98-515a-8baa-967e4de33196", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:48765d0b-f8b6-5d17-85ad-2fbdff7c39dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:8b2ee29a-73ec-53b3-9002-af21c5bc991d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:0ed5ff70-420c-53cb-9729-9d506f462159", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2026-47889. The vulnerability specifically affects the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java), which was introduced in version 6.2.0-M5. Version 6.1.4 uses a servlet-based Jetty adapter (JettyHttpHandlerAdapter with ServletServerHttpResponse) that properly handles the sameSite cookie attribute via servlet APIs.", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:8195409f-b09d-5c8e-ba58-4e8ae23d176d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ], "bom-ref": "urn:uuid:01f14967-d4db-5176-8168-63ae3b1f6c51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.9" } ] }