{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5ce22109-b55d-5f5e-9981-4f499b980234", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2", "version": "6.2.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.7", "type": "library", "group": "org.springframework", "version": "6.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c342cdfc-5c47-5d23-8c4d-953725daa140", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 (XXE in SourceHttpMessageConverter) is NOT present in the target. The upstream fix commit 2ae6a6a341 by Rossen Stoyanchev (Spring/Pivotal) was already included in the Spring Framework 6.2.7 upstream release that TuxCare onboarded. The code at HEAD disables external entity processing by default (processExternalEntities=false) and configures all XML parsers (DOM, SAX, StAX) with sec...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2d7bf2e6-c2bd-55b3-bca1-b8b01a22bc1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 6.2.7. The vulnerability affects the JavaScriptUtils.javaScriptEscape method which failed to properly escape four dangerous characters: left angle bracket (<), right angle bracket (>), Unicode line separator (\\u2028), and Unicode paragraph separator (\\u2029). These unescaped characters could allow XSS attacks when user-controlled strings are embe...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:53b25fee-d8fe-5fed-8e75-ba248f638226", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 6.2.7. The vulnerability, which allowed denial of service through malicious XML with inline DTD declarations causing memory exhaustion, was fixed by upstream Spring developers in 2015. The fix (commit d79ec68db4) disables DTD processing by default across all XML parsers. This fix was already included in the upstream Spring Framework v6.2.7 releas...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:018b4e5e-a07d-5473-9362-275e636fab31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. CVE-2016-1000027 affects Spring Framework's HTTP Invoker remoting classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, etc.) which use Java serialization and are vulnerable to RCE via deserialization of untrusted data. The target version 6.2.7 is NOT affected because these vulnerable classes were completely removed in upstream version 6.0.0 (commit 5822f1bf85 by Juergen Hoeller, Sep 2021). TuxCare onboarded version 6.2.7 which already had this upstream fix. No httpinvoker or remoting classes exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:deafc121-4648-55dd-8c16-ffea51cd27bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 6.2.7. The vulnerability allowed arbitrary HTTP method overrides (including TRACE) via HiddenHttpMethodFilter's _method parameter, enabling XST attacks. The upstream fix restricts method overrides to only PUT, DELETE, and PATCH. Both HiddenHttpMethodFilter variants (Servlet and Reactive) in the target contain this fix, which shipped in the upstr...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1b201e5b-3953-526e-9876-853e962807e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. The target version 6.2.7 already contains the upstream fix (commits cce60c479c and 0d0d75e253) that replaced predictable temporary directory paths with random directories via Files.createTempDirectory(). The vulnerable pattern (fixed paths like /tmp/spring-multipart) is not present. DefaultPartHttpMessageReader uses FileStorage.tempDirectory() for random temp directories, and SynchronossPartHttpMessageReader was removed entirely during Jakarta EE 9 migration. The fix was shipped in the upstream 6.2.7 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:12d460b2-6810-59be-8300-06e6b39160fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. Target version 6.2.7 is NOT AFFECTED by CVE-2024-22243. The vulnerability was fixed in upstream Spring Framework commit 120ea0a51c (2024-02-09) by updating the USERINFO_PATTERN regex, and the fix shipped in the upstream v6.2.7 release before TuxCare onboarding. Subsequently, Spring Framework 6.2 completely replaced the regex-based URI parser with a new state-machine parser (RfcUriParser), making the original fix obsolete but maintaining protection. The new parser explicitly rejects malformed URIs like `http://trusted.com[...]@evil.com` with \"Bad authority\" errors, preventing the SSRF/open redirect attack vector. The vulnerable code pattern (old regex-based parser with flawed USERINFO_PATTERN) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e5c0d274-e882-552a-901b-608c040bfc26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.7 is not affected by CVE-2024-22259. The vulnerable regex-based URL parsing code has been replaced by a robust state-machine parser (RfcUriParser) that inherently provides the same protections as the CVE fix. This refactoring was authored by upstream Spring Framework (rossen.stoyanchev@broadcom.com) and shipped in the 6.2.7 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:18a102d4-97e6-5ff9-8d99-ecf4a6670005", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.7 is not affected by CVE-2024-22262. The vulnerable regex-based URI parsing code was completely replaced by a state-machine-based RFC parser in version 6.2.0, which inherently rejects backslash characters in URI components (scheme, userinfo, host, port). This architectural change was authored by upstream Spring developers and included in the 6.2.7 release, preventing the open redirect/SSRF vulnerability that could occur when parsing malformed URLs with backslashes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:69f90650-5575-5363-9d6a-5cedb5c97dc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.7 is NOT vulnerable to CVE-2024-38809. The vulnerable regex-based ETag parsing (ETAG_HEADER_VALUE_PATTERN pattern causing catastrophic backtracking) was replaced with a linear-time state-machine parser in upstream commit bb17ad8314 by rossen.stoyanchev@broadcom.com. This fix was already present in the upstream Spring Framework 6.2.7 release that TuxCare onboarded (commit 3c...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:92e97868-64b2-5000-b9ce-cd641e4df745", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.7 is NOT vulnerable to CVE-2024-38820. The upstream release shipped with a refactored fix that uses PatternMatchUtils.simpleMatchIgnoreCase() for case-insensitive pattern matching in DataBinder.isAllowed(), which employs locale-independent Unicode case folding via String.equalsIgnoreCase() and String.regionMatches(ignoreCase=true). The vulnerable pattern (using S...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:832c85ea-ebf8-52fc-9015-34ab9d3bc898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ccced47e-57cf-5382-a2f2-6aed704c5f0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c7e851c8-2a5d-5ef7-9bca-691d76d32810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ddf5c6dc-7ee1-5396-aa17-a0ca014259a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:22b2ade8-d8aa-5214-a8cb-67cf8e9462ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2d9cf7c2-004a-55bb-b52b-017ef93635eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2b7b086c-2422-58da-855f-bae8a9caa242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.7-tuxcare.2" } ] }