{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:96a0b60e-bbc8-5dc2-ae36-be9dfb2d4027", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14", "version": "3.0.5.RELEASE-tuxcare.14", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE", "type": "library", "group": "org.springframework", "version": "3.0.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:24edfa58-eb60-5695-9325-b6f37114faf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0054 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:b1c41aa1-af4b-5ce1-89cb-0cf7d4467c1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0225 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:02ef9dc0-4503-593a-8651-21f1dfbfe229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-1904 affects version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:53653f54-56da-5a6c-8d3e-1b1473f53553", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3625 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:0279676c-4add-5168-bb55-847419af6892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-9878 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:eedf71b2-e5f7-5358-94cc-2649db7c4f9f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE is NOT AFFECTED by CVE-2020-5397. The target version predates CORS (Cross-Origin Resource Sharing) support entirely - CORS was introduced in Spring Framework 4.2 (2015), while version 3.0.5 was released in 2011. The vulnerability specifically affects CORS preflight request handling in the spring-webmvc and spring-webflux modules. The target lacks the entire CORS i...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:1de7aaa5-23c0-5e70-afd7-5dd112a86288", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:9b2e6eec-a95c-5997-a537-1b4ba744bb95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:bbd04c40-7a21-5ecc-ba18-f3d44d02f9c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc, and is fixed in 3.0.5.RELEASE-tuxcare.15." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:9726892f-d051-5865-a10c-117bdb334c4c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE is not affected by CVE-2023-34053. The vulnerability requires the observation/metrics infrastructure with Micrometer integration that was introduced in Spring Framework 6.0 (November 2022). Spring 3.0.5 (December 2010) predates this feature by over 10 years. The vulnerable code path - DefaultServerRequestObservationConvention creating unbounded KeyValue objects fo...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:b0b61c4d-aab0-5e3d-b753-1fde412d58d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:0b2c07d1-0f7d-5614-a6f9-1863d27cd13b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:7bc8feda-78f5-5813-9a09-a8cb020c4ac3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:8129ece4-cb15-5744-a21b-e85c41abf902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:f10022bf-f403-5c2b-b5c6-6dffefece9e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 3.0.5.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:49b8e88e-2e32-5d41-a1e1-22ad0739dd6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 4.0.0.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:2cfb94f8-3f4f-553d-96fe-e923b8c8713d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE is not affected by CVE-2026-22741. The vulnerable component (CachingResourceResolver) and the resource chain infrastructure were not introduced until Spring Framework 4.1.0.RC1. Version 3.0.5 uses a simpler ResourceHttpRequestHandler that resolves resources on every request without application-level caching, making the cache poisoning attack described in the CVE i...", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:0f0cd4dc-1f54-58ce-a028-630a3daf8bf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:c30d31ec-9ab9-5bc0-a66f-86ea63d39128", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE is not affected by CVE-2026-41841. The vulnerability requires the CachingResourceResolver class and ResourceResolver chain architecture, which were introduced in Spring Framework 4.1 (2014), approximately 4 years after this version. Spring 3.0.5 uses ResourceHttpRequestHandler without any resource caching mechanism, making cache key collision impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:2f9bfe77-b99f-5bb2-a3c5-c6778702a12b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the vulnerable content-based version strategy feature. The vulnerability requires VersionResourceResolver and VersionStrategy classes with removeVersion() logic that removes all instances of version strings from request paths. This feature was introduced in Spring Framework 4.1 (2013), approximately 3 years after Spring 3.0.5 (2010). The target's ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:2d4e7ff7-d2e8-586f-9201-806e4c0c43f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the vulnerable content-based version strategy feature. The CVE-2026-41843 vulnerability affects Spring Framework versions 5.3.0+ where content-based versioning with automatic version string removal exists. Version 3.0.5 (from 2009-2010) predates this feature entirely and uses a simpler resource handling architecture without version strategy classe...", "justification": "code_not_present" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:e855bf65-7f67-5815-bcd9-c33b115637f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:3d933203-3b75-5223-b283-cde5a8318875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:276e3b33-e60e-5453-a927-95723e007294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:b1f2e9dc-82c2-57cb-97be-7d64cae7f2c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE (target version) is not affected by CVE-2026-41853. The vulnerability targets Spring Framework 5.3.0+ which introduced Spring's own multipart parsing implementation. Version 3.0.5 delegates all multipart parsing to Apache Commons FileUpload 1.2.0 and contains no Spring-specific multipart boundary or content-length parsing code. The architectural difference means t...", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:b54f5fcd-7966-51fb-a7e2-d92bc68705e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the UrlHandlerFilter component that is affected by CVE-2026-47883. The vulnerability concerns an open redirect in UrlHandlerFilter's trailing-slash-redirect functionality when configured with broadly matching patterns. This component was introduced in Spring Framework 6.x, many years after version 3.0.5 (released ~2011). The target version has no ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:5c6841b5-ab6e-509d-bf72-7e8c79fa04e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:9935b172-672f-5c7a-9aab-62529a7bd43f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:c97ba603-0f04-507c-8d27-169c92b8ed9a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 3.0.5.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ], "bom-ref": "urn:uuid:ca8f1cd8-7cfe-5446-8f96-204e6988c014", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 3.0.5.RELEASE-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.0.5.RELEASE predates both Server-Sent Events (SSE) support and the functional web framework required by CVE-2026-59313. SSE support was introduced in Spring 4.2 (2015), and the functional web framework (RouterFunction, ServerResponse) was introduced in Spring 5.0 (2017). The target version from 2011 contains none of the affected SSE classes (SseEmitter, ServerSentEvent, SseSe...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.0.5.RELEASE-tuxcare.14" } ] }