{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d45fca5-e660-51f7-9a38-79057fac693c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6", "version": "3.1.1.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "3.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:91c69a7b-13fd-564e-8f62-e4ec04dd55d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0054 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d2cfddc7-833f-5e73-8704-62031f814305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0225 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:317cddf8-ea52-5d03-9f66-49c1ae18724b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-1904 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:61b80fff-e6d1-56ba-9d95-c63c30ecee0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3625 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:649e8954-d82d-5de2-9ca8-9aada47414e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-9878 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f63378d0-a251-5056-9afd-6f70c22f4eca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5397. The vulnerability exists in CORS (Cross-Origin Resource Sharing) preflight request handling logic, which was not yet implemented in this version. CORS support was introduced in Spring Framework 4.2.0 (April-July 2015), over 3 years after the 3.1.1.RELEASE (February 2012). Without CORS functionality, the vulnerable code pattern (im...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cdd8d31f-8866-5cb8-8996-92463c1d5630", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:233775b3-002b-51e9-8a41-df93f895fdea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7182df91-2b82-5f02-8ad4-530a5174a350", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8f678e7d-8b2a-5f3b-bfd1-96bd6ec1e3e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2023-34053. This DoS vulnerability involves unbounded allocation of metric dimension objects when processing arbitrary HTTP method names through Spring's Micrometer observation conventions. However, the entire observation/micrometer integration feature did not exist in Spring Framework 3.1.1 (released ~2012). The vulnerability requires class...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3e1b336c-224f-5068-844e-3855b0779f56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:46305126-037a-5acf-9bfa-c5b2941bc113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:63783c8a-5f18-54ea-8938-0a8cae84f224", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6d4d83b3-ca47-54b2-be7f-d2ecefdac07e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5caac8d1-6b83-5a87-b1ff-867484cb3a38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:53585835-0cab-5fd0-aed3-220d41043265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fbaa6798-ed0c-51e7-98de-2bea63ac06f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-22741. The vulnerable component (CachingResourceResolver) and the resource chain infrastructure were not introduced until Spring Framework 4.1.0.RC1. Version 3.0.5 uses a simpler ResourceHttpRequestHandler that resolves resources on every request without application-level caching, making the cache poisoning attack described in the CVE i...", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:01dae251-0042-5f28-b4e5-1a9f3528baab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:92a4f428-2d3d-5683-9e6e-b8b88da26827", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 does not contain the vulnerable CachingResourceResolver class or any server-side caching mechanism for static resource resolution. The vulnerability (CVE-2026-41841) is specific to the caching resolver feature introduced in Spring 4.1.0, approximately 2-3 years after this version was released.", "justification": "code_not_present" } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c39b368a-dcde-587d-94fb-3be729bc5b61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is NOT affected by CVE-2026-41842. The vulnerability exists in content-based version strategies for static resource handling, a feature introduced in Spring Framework 4.1 (2014). Spring 3.1.1 (2011) predates this feature and contains no version removal logic in resource handling.", "justification": "code_not_present" } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a72ecf51-7f18-5e2c-a197-081b048738b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-41843. The vulnerability requires the content-based version strategy feature (VersionResourceResolver, AbstractVersionStrategy, etc.) which was introduced in Spring Framework 4.1+. This feature does not exist in version 3.1.1, making the attack chain impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3886722f-c463-56bc-afb4-78c6dd506cf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d812a5ed-1552-5a7e-9990-0f01c906e338", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41845 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE (2012) predates the ECMAScript 6 specification (2015) that introduced template literal syntax. While the code lacks escaping for backtick (`) and dollar sign ($) characters in JavaScriptUtils.javaScriptEscape(), these unescaped characters cannot lead to arbitrary JavaScript code execution in the pre-ES6 JavaScript environment this version was designed for. The att...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:341a483a-e048-5bba-8e5a-5a691c7fdd98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:69e070be-ddc4-523c-b8a8-a93e5585ec8e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is not affected by CVE-2026-41853. This version predates the affected version range (5.3.0+) and lacks the vulnerable components. Spring 3.1.1 does not implement custom multipart boundary parsing; it delegates all multipart parsing to external libraries (Apache Commons FileUpload or Servlet 3.0 Part API). The CVE specifically mentions 'Spring MVC and WebFlux' - WebFlux wa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0181bed0-fc7d-500e-aa15-e5ca355b0beb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2+, approximately 10+ years after version 3.1.1.RELEASE (2012). The target repository contains no references to UrlHandlerFilter, and TuxCare has only backported fixes for this CVE to 6.2.x branches wh...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f70a9d56-2a44-5452-8f53-799aaec16886", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0e9d7ebb-69c7-5a5b-b751-5943ba8150e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9f041eaf-bded-53b1-9dd8-16e4d285f22e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 3.1.1.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:16bb29e9-f45a-555c-9679-cc8d78916729", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-59313. This vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) for Server-Sent Events, which was introduced in Spring 5.0 (2017). The target version 3.1.1.RELEASE (2012) predates this feature by 5 years and contains no SSE-related code. The SSE support itself (SseEmitter) was first introd...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.6" } ] }