{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:57caefa3-e6a2-5ab7-99de-08f5999b9459", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2", "version": "6.2.12-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.12", "type": "library", "group": "org.springframework", "version": "6.2.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3caa4fa7-38ac-5c87-ac16-de888f268247", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.12 is not affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed by upstream Spring in 2014 (commit edba32b309), years before this version was released. The fix disables external entity processing by default (processExternalEntities=false) across all XML parsing paths (DOM, SAX, StAX), with explicit parser feature flags and NO_OP resolvers ...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c91bc5a2-d48c-5d06-8fd4-2590b80f591e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430: Target Spring Framework 6.2.12 is NOT AFFECTED. The vulnerability in JavaScriptUtils.javaScriptEscape (missing escapes for <, >, \\u2028, \\u2029 characters) was fixed by upstream commit f5c9fe69a4 authored by rstoyanchev@vmware.com. This fix was already present in the upstream Spring Framework release before TuxCare started maintaining version 6.2.12. The JavaScriptUtils.java file...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:0aaa9a2f-2387-5d4f-a900-fbdeb8f7660b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.12 is not affected by CVE-2015-3192. The DTD protection fix (disabling DTD parsing by default) was already present in the upstream Spring Framework 6.x release before TuxCare began maintaining this version. The vulnerable pattern (unprotected XML parsing that allows DTD-based memory exhaustion attacks) does not exist in this version. All XML parsers handling untrusted input...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ec6a7ed1-fba4-5307-8f06-040ebc51e90b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. Target version 6.2.12 is not affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter, etc.) were completely removed from Spring Framework in version 6.0.0 by upstream commit 5822f1bf85 (September 2021). Comprehensive searches confirm no HttpInvoker-related code exists in the target repository. The removal was an upstream fix that shipped in the Spring Framework 6.0.0 release, predating TuxCare's involvement with this version by thousands of commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e36a9dac-5709-56ad-99ae-2b480eb78e78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is not present in Spring Framework 6.2.12. The vulnerability allowed arbitrary HTTP method override (including TRACE for XST attacks) via HiddenHttpMethodFilter's _method parameter. The fix, which restricts allowed methods to PUT, DELETE, and PATCH only, was committed by upstream in May 2018 (commits a5cd01a4c857 and f64fa3dea10af) and shipped in the upstream release before TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:62cebd11-ea96-5d62-8f02-651cd30a5b66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. CVE-2021-22118 affects WebFlux applications using predictable temporary directory paths for multipart file uploads, allowing local attackers to manipulate the storage location. The target repository at version 6.2.12 contains the upstream fix that replaces fixed predictable paths with random unpredictable directories via Files.createTempDirectory(). This fix was authored by apoutsma@pivotal.io and was already present in the upstream Spring Framework release before TuxCare onboarding. The vulnerable code pattern (fixed paths like /tmp/spring-multipart) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:50a525c3-e2b1-54aa-89d4-34f1c4ff42c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.12 is not affected by CVE-2024-22243. The vulnerable regex-based USERINFO_PATTERN does not exist in this version. Version 6.2.12 uses RfcUriParser, a state-machine based URL parser introduced by upstream Spring in October 2024 that correctly handles '@' and '[' characters, preventing incorrect host extraction that could lead to open redirect or SSRF. The architectural change removing regex-based parsing was shipped in the upstream release (commit 6c62965cbb by rossen.stoyanchev@broadcom.com) before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c9208caf-9836-5a01-a7d8-ec82b334de45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. Spring Framework version 6.2.12 is not affected by CVE-2024-22259. The vulnerability affects regex-based URI parsing code (USERINFO_PATTERN, HOST_IPV4_PATTERN) in older Spring Framework versions (5.x, 6.0.x, 6.1.x). Version 6.2.x introduced a complete architectural change: the regex-based parser was removed (commit 6c62965cbb, Oct 2024) and replaced with RfcUriParser and WhatWgUrlParser state machine parsers. The new implementation explicitly handles @ and [ characters correctly, preventing the host confusion attacks that CVE-2024-22259 addresses. The vulnerable code patterns simply do not exist in version 6.2.12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:37e763de-b66e-5c25-930d-0b670b50391f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.12 is NOT affected by CVE-2024-22262. The vulnerability existed in older versions (5.x and earlier) that used regex-based URI parsing with patterns like SCHEME_PATTERN=\"([^:/?#]+):\" and HOST_IPV4_PATTERN=\"[^/?#:]*\" which did not exclude backslashes, allowing URLs like \"http://evil.com\\@trusted.com\" to bypass host validation. Spring 6.2 introduced a complete architectural change (commit 52805da7 by upstream) replacing regex parsing with an RFC 3986-compliant state-machine parser (RfcUriParser.java). The new parser validates each character in the HOST state against RFC 3986 unreserved and sub-delimiter sets, rejecting backslashes with InvalidUrlException. The vulnerable regex patterns are completely absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:385a750e-586e-5a26-9282-697110d03a6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.12-tuxcare.2. The vulnerable regex-based ETag parsing (ETAG_HEADER_VALUE_PATTERN) was replaced with a bounded linear-time state machine parser by upstream Spring Framework in commit bb17ad8314b81850a939fd265fb53b3361705e85, which shipped in version 6.1.12. The target version (6.2.12) was released after this fix and contains the secure implem...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:00a8277b-0d6a-5c88-8474-785f96ffc723", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. Version 6.2.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:f51a4307-94de-5f96-833e-0f7251876fa2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.12-tuxcare.2 is not affected by CVE-2025-41234 (Reflected File Download via Content-Disposition header). The fix for this vulnerability was already present in the upstream Spring Framework 6.2.12 release when TuxCare onboarded it. The fix (commit f0e7b42704e by Brian Clozel from Broadcom) marks double-quote characters (ASCII 34) as non-printable in the PRINTABLE ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:df927d26-0559-5353-a444-2ae3fc00b9a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2272eb5b-1442-510c-8f77-4df8c96e4c0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3f1ea2ab-a531-526c-9daf-2661f539c1e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:93a95cc5-4e0c-564c-a5be-14690ead1ef4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:64f53140-2c40-581f-9825-16d9b440602c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8ee246e9-81cc-5087-aba2-f82b3754ba6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.12-tuxcare.2" } ] }