{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ab36b4e2-09ea-5f5b-88c0-792a35a86071", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2", "version": "6.2.19-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.19", "type": "library", "group": "org.springframework", "version": "6.2.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:4ba55d81-8f3e-5dbf-b157-24a01194ee0d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.19 is not affected by CVE-2013-6429 (XXE in SourceHttpMessageConverter). The vulnerability was fixed in upstream Spring Framework 3.2.5/4.0.0 in November 2013 via commit 2ae6a6a3. Version 6.2.19 inherited this fix from upstream \u2014 the processExternalEntities defense (disabled by default) with comprehensive SAX/DOM/StAX protections was already present in the upstream 6.2.19 r...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:7ea8a21d-544c-5558-b374-b8155e8e69b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 6.2.19-tuxcare.3. The vulnerability affected JavaScriptUtils.javaScriptEscape which failed to escape angle brackets (<, >) and Unicode line/paragraph separators (U+2028, U+2029), enabling XSS attacks. The upstream fix was applied by Rossen Stoyanchev in commit f5c9fe69a4 on February 15, 2013 (Spring Framework 3.2.2), adding Unicode escape sequenc...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:2c83aed9-83a2-5708-8004-6080d8e79470", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.19 is not affected by CVE-2015-3192. The vulnerability requires the ability to send XML documents with inline DTD declarations that cause memory exhaustion through entity expansion. The upstream Spring Framework release 6.2.19 already contains the fix (commit d79ec68db40c) that disables DTD processing by default through the `disallow-doctype-decl` XML parser feat...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:ec3d51af-8bf8-5577-a884-376ec9c276aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. CVE-2016-1000027 concerns unsafe Java deserialization in Spring Framework's HTTP Invoker remoting classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean). These classes were completely removed from Spring Framework in version 6.0.0 (commit 5822f1bf85, September 2021) by upstream developer Juergen Hoeller. The target repository is at version 6.2.19-tuxcare.3, which is well after the removal. No remoting classes exist in the codebase. The fix was already present in the upstream release that TuxCare onboarded, not applied by TuxCare. Verdict: not_affected (upstream fix; vulnerable code not present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:4436a29f-cfcb-5393-bdd6-44c700336c94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.19 is not affected by CVE-2018-11039. Both HiddenHttpMethodFilter implementations (servlet and reactive) contain the required ALLOWED_METHODS whitelist defense that restricts method overrides to PUT, DELETE, and PATCH only, preventing arbitrary methods like TRACE from being executed. The fix was authored by Brian Clozel (bclozel@pivotal.io) in May 2018 and was al...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9b4ff8f6-2a0e-5215-bf6c-6af581ce1e3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.19 is NOT affected by CVE-2021-22118. The vulnerability (predictable temporary directory paths for multipart uploads) was fixed by upstream Spring Framework in commit 0d0d75e253 (May 2021) for versions 5.2.15 and 5.3.7. This fix was already present in the upstream Spring Framework 6.2.19 release that TuxCare onboarded. The target uses FileStorage.tempDirectory() which creates unique, unpredictable temporary directories via Files.createTempDirectory() with random suffixes, preventing the directory collision/manipulation attack. SynchronossPartHttpMessageReader (also patched upstream) is not present in the 6.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5dcca6ba-1d7f-5a92-b1d0-18385a6106c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.19 is not affected by CVE-2024-22243. The vulnerability targeted the USERINFO_PATTERN regex in the old URI parser, which was used in versions 4.x, 5.x, and early 6.0.x. Version 6.2.19 uses a completely rewritten parser architecture (RfcUriParser and WhatWgUrlParser) introduced in October 2024, eight months after the CVE fix. The vulnerable regex pattern does not exist in this version, and the new state-machine based parsers have strict validation that prevents the host misidentification attack the CVE describes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:9200c488-164c-571c-966c-a551e3401036", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.19 is NOT affected by CVE-2024-22259. The vulnerability involves URL parsing flaws where malformed IPv6 brackets or @ characters could cause the parser to extract an incorrect host value, bypassing validation checks and enabling open redirect or SSRF attacks. However, Spring 6.2.19 uses a completely refactored URI parsing architecture (state machine-based RfcUriParser) instead of the regex-based approach used in older versions. The upstream fix (commit ce90e4b11f, \"RfcParser rejects invalid IPv6 host\", May 11 2026) was already present in the upstream 6.2.19 release before TuxCare onboarding (July 6 2026). The fix validates IPv6 brackets and properly handles @ character disambiguation, providing equivalent protection to the CVE-2024-22259 patches applied to older Spring versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:edbfd265-ed12-5980-b60c-a19f56a70331", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.19 is not affected by CVE-2024-22262. The vulnerability existed in regex-based URI parsing used in versions 5.x and earlier. Version 6.2.0 introduced new URI parsers (RfcUriParser and WhatWgUrlParser) and removed the vulnerable regex patterns in upstream commit 6c62965cbb (2024-10-04) before TuxCare onboarded version 6.2.19. The default RFC parser properly rejects backslashes in authority components per RFC 3986, preventing the validation bypass described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:4989ec91-f6b9-50e8-b7c2-1fb5b22266ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.19-tuxcare.3. The vulnerability (ReDoS via regex backtracking in ETag header parsing) was already fixed in the upstream Spring Framework 6.2.19 release. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 (\"Efficient ETag parsing\" by rossen.stoyanchev@broadcom.com) replaced the vulnerable regex pattern with a linear state-machine parser....", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:28003ab1-8441-5a85-8507-c5d68a3ef232", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. Version 6.2.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:425ee510-1af2-5505-bbf4-c92ceb9444c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.19-tuxcare.3 is not affected by CVE-2025-41234 (reflected file download via unencoded quotes in Content-Disposition headers). The upstream fix commit f0e7b42704e6b33958f242d91bd690d6ef7ada9c, authored by brian.clozel@broadcom.com on 2025-06-12, was already present in the upstream Spring Framework 6.2.19 release that TuxCare onboarded on 2026-07-06. The fix adds `...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:21d3611c-302e-5525-bf88-6e7e21c915b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41845 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:c810a313-383b-5743-9f18-4b25b5256590", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-web. 6.2.19 is not vulnerable, as it is\u00a0outside affected range (>= 6.2.0, <= 6.2.18)", "justification": "code_not_present" } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:57866daa-cb08-5487-a611-5a69f1be5bb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:a642d35a-e3c6-50a1-a354-27cd4ce13b27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:5a789bc3-ef56-545a-9840-161a5fc551ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.19-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ], "bom-ref": "urn:uuid:20868ea8-0dfd-528a-a6a8-6ec5992fb342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.19-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.19-tuxcare.2" } ] }