{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:48a66701-46da-5060-a4e1-f5ddcd54807a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7", "version": "4.1.7.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "4.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:59bd9802-745e-5019-8c5a-44c141066533", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Target version 4.1.7.RELEASE is not affected. The XXE vulnerability fix was already present in the upstream Spring Framework release. Commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 (authored by Rossen Stoyanchev @gopivotal.com on 2014-02-18) added complete XXE protection to all three affected HTTP message converters (Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter, Jaxb2Collec...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1ec5c257-2f4d-53a0-ac83-c3c72c9f56a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. The target Spring Framework 4.1.7.RELEASE is not affected by CVE-2014-0225 (XXE vulnerability). The upstream vendor fix that disables external entity resolution in XML parsers was already included in the Spring Framework 4.1.7.RELEASE release (June 2015), which TuxCare subsequently onboarded. All five affected source files (Jaxb2Marshaller, AbstractMarshaller, Jaxb2CollectionHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter) contain the NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER implementations that prevent XXE attacks by returning empty content instead of resolving external entity URIs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e7f75a34-ec12-5793-b8c7-9f6f0f7d4324", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability is NOT present in Spring Framework 4.1.7.RELEASE-tuxcare.7. The upstream fix (commit 741b4b229a by Rossen Stoyanchev) that adds URI path encoding via UriUtils.encodePath() was already included in the upstream 4.1.7.RELEASE before TuxCare onboarded this version. The vulnerable pattern (unencoded request URI in form action attribute) does not exist in the target.", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:00cc05ae-3134-52c3-a728-33d94da3ca5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 fix is present in target version 4.1.7.RELEASE. The vulnerability affects Spring Framework 4.1.x before 4.1.2, but the target is version 4.1.7, which includes the complete upstream fix. All defense mechanisms (processPath, isInvalidPath, isInvalidEncodedPath, checkResource, isResourceUnderLocation) are present and on the execution path. The fix was authored by the upstream Spring ...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:33362d4f-20c1-5290-9603-a4a73f4812e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9878 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c6508a62-9d8e-52e8-b7f4-c8c2629c8de3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2020-5397. This version predates the introduction of CORS support to Spring Framework, which was added in April 2015 (targeting Spring 4.2+). The vulnerability requires CORS preflight request handling code that does not exist in 4.1.7.RELEASE. Specifically, the target lacks: (1) CorsUtils.isPreFlightRequest() method that performs preflight d...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:cd0cad36-bac9-58f0-b61c-f0943591b364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:401f2e26-8640-5c7e-b1aa-3629bd3482d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:fcdcff28-9b2b-5e4a-a770-59c6900e4908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:6a4e7ecb-91d0-57c5-819b-0ab8d8c89b52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.7.RELEASE-tuxcare.7 is not affected by CVE-2023-34053. The vulnerability requires the observation/metrics infrastructure with Micrometer integration introduced in Spring Framework 6.0 (November 2022). This infrastructure is completely absent from version 4.1.7 (released 2015). While the target accepts HTTP requests with arbitrary method names (the INPUT), no code path exist...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8fe099d7-fcbe-579d-92aa-e3c98122dfce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:654bdb66-ba96-5b4c-9e55-616427511902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:d171b680-eeeb-50e8-8277-3721de8c5931", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc, and is fixed in 4.1.7.RELEASE-tuxcare.8." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:cbc568a8-5859-527f-a12c-a47fc44d7c52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a370d0ca-17cf-5f24-8b41-619ccee0d381", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 4.1.7.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:3715705f-10d9-5de4-9f98-eab11ede03ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 4.1.7.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:3e4f1f68-e20e-5412-8db9-b286bc30706b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c46b71ab-478d-5cdc-8374-60089dd2e8a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f7756bc4-0160-5ea6-8396-102afd31aab0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:871c406f-2e28-56ae-a7e6-610ba7fb467c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b0169817-3d47-5f37-9d00-66d74ec11717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:485d96ab-9012-54af-a691-a1cc5cb1c176", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c59282dc-1902-5450-a261-a24f98b24db8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:0344739e-b82c-5970-a5da-1795c532f254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ac4b9b77-8ee2-5854-8647-808016f07a03", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.7 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in Spring 5.0) and contains no Spring-specific multipart parser. All multipart request parsing is delegated to external libraries (Apache Commons FileUpload 1.3.1 or Servlet 3.0 API). The vulnerability described in the CVE targets Spring's own multipart handling code introduced in later ve...", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b1894825-f187-51c2-b861-513847116b9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2026-47883 because the vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.x around May 2024, approximately 9 years after version 4.1.7.RELEASE. The target contains no equivalent functionality for automatic trailing-slash redirect handling that could lead to protocol...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f8c127ca-be40-5acb-a2b1-dd20f55988d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:3e98a26b-eca5-59c2-9390-1a945fd30f95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7c995e36-17fb-55ca-9953-fab379d74131", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.1.7.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8270b9f6-2b6f-55ca-99f6-0ad19b9f56d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2026-59313. The vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) and Server-Sent Events (SSE) support, neither of which exist in version 4.1.7. SSE support was introduced in Spring 4.2 (July 2015), and the functional web framework was introduced in Spring 5.0 (September 2017), both after the...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.1.7.RELEASE-tuxcare.7" } ] }