{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e4792bf-a2c2-541f-af60-629f70f75c04", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4", "version": "3.1.1.RELEASE-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "3.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:41f37aac-5d82-544a-a36f-d3548735e1cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0054 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:885d177e-1316-5c0f-a10e-dd7869e439cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0225 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:6a034d4f-065f-5773-bae5-7bc2e98dde7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-1904 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ffd30aed-5a44-5425-87be-9f3a3323f4b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3625 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:7cf03a54-48c7-5881-b74e-1c558a1f0893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-9878 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:c123c865-86e9-5082-bc97-a75f2c6322fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5397. The vulnerability exists in CORS (Cross-Origin Resource Sharing) preflight request handling logic, which was not yet implemented in this version. CORS support was introduced in Spring Framework 4.2.0 (April-July 2015), over 3 years after the 3.1.1.RELEASE (February 2012). Without CORS functionality, the vulnerable code pattern (im...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:e1f2cfab-21b0-5ab0-accf-cc1157e942ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:6db935f0-5862-57da-8766-7014e1a86edb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:fe9bf52e-02bf-5fae-bc92-7885c24b8859", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:7195fbc9-69a2-57d2-8d44-765d8d49b978", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2023-34053. This DoS vulnerability involves unbounded allocation of metric dimension objects when processing arbitrary HTTP method names through Spring's Micrometer observation conventions. However, the entire observation/micrometer integration feature did not exist in Spring Framework 3.1.1 (released ~2012). The vulnerability requires class...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:63204e26-2431-5eba-ba92-db70a2c25e07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:912e1e29-1db6-5ec5-86c3-b7df1ff3ad09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:57ee4487-d3fc-568a-bdae-f781c08408f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:e63bfa37-ef06-5185-b947-d09f419bf69b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ac79cdc2-ab32-562e-bf41-6fb6c9c5662f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:de2b28e0-c930-513d-9251-6c38e8c162d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:59f61b4f-e70b-50b5-af29-f4f6cae2859b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-22741. The vulnerable component (CachingResourceResolver) and the resource chain infrastructure were not introduced until Spring Framework 4.1.0.RC1. Version 3.0.5 uses a simpler ResourceHttpRequestHandler that resolves resources on every request without application-level caching, making the cache poisoning attack described in the CVE i...", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:b1ffc894-ff76-5295-84c4-9bb8fcb3ed14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:0cc932ab-9364-56cb-adc3-f4a5ed0f31a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 does not contain the vulnerable CachingResourceResolver class or any server-side caching mechanism for static resource resolution. The vulnerability (CVE-2026-41841) is specific to the caching resolver feature introduced in Spring 4.1.0, approximately 2-3 years after this version was released.", "justification": "code_not_present" } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:f7eb585b-47b0-5609-824e-4af8669b3c71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is NOT affected by CVE-2026-41842. The vulnerability exists in content-based version strategies for static resource handling, a feature introduced in Spring Framework 4.1 (2014). Spring 3.1.1 (2011) predates this feature and contains no version removal logic in resource handling.", "justification": "code_not_present" } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:565e6f8a-47d3-5039-963a-d989ccc1578d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-41843. The vulnerability requires the content-based version strategy feature (VersionResourceResolver, AbstractVersionStrategy, etc.) which was introduced in Spring Framework 4.1+. This feature does not exist in version 3.1.1, making the attack chain impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:9edd795f-a73b-528c-9449-a20148fa7339", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:675326c6-5f85-5c1f-ae62-f4b708dd3c3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41845 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE (2012) predates the ECMAScript 6 specification (2015) that introduced template literal syntax. While the code lacks escaping for backtick (`) and dollar sign ($) characters in JavaScriptUtils.javaScriptEscape(), these unescaped characters cannot lead to arbitrary JavaScript code execution in the pre-ES6 JavaScript environment this version was designed for. The att...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:147adf67-c25c-5ccb-b266-017ec3aec8ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:0fcbb611-c87e-53d8-a0f1-2129c13197cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is not affected by CVE-2026-41853. This version predates the affected version range (5.3.0+) and lacks the vulnerable components. Spring 3.1.1 does not implement custom multipart boundary parsing; it delegates all multipart parsing to external libraries (Apache Commons FileUpload or Servlet 3.0 Part API). The CVE specifically mentions 'Spring MVC and WebFlux' - WebFlux wa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:1c631179-0642-53d1-95ec-7981be9e7ee6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2+, approximately 10+ years after version 3.1.1.RELEASE (2012). The target repository contains no references to UrlHandlerFilter, and TuxCare has only backported fixes for this CVE to 6.2.x branches wh...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ac40d0c8-e224-56cc-8fbf-ac8ca5d247cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ee7a3e69-1b40-55cd-8eb4-e2977deb8342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:3b8bf163-f256-5222-9551-1e202010a7da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 3.1.1.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:72791446-5bfc-55af-902a-a02e39e70839", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-59313. This vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) for Server-Sent Events, which was introduced in Spring 5.0 (2017). The target version 3.1.1.RELEASE (2012) predates this feature by 5 years and contains no SSE-related code. The SSE support itself (SseEmitter) was first introd...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4" } ] }