{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2bc2365e-3b4d-5aa8-b38b-78d88ebdd1a4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12", "version": "4.2.9.RELEASE-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:448600ac-040e-507a-a6b3-8a875f27e0fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 The target version 4.2.9.RELEASE is not affected by CVE-2014-0054. The XXE (XML External Entity) vulnerability pattern is not present because the upstream Spring Framework fix was already included in version 4.0.2.RELEASE, well before the 4.2.9.RELEASE that TuxCare onboarded. Both Jaxb2RootElementHttpMessageConverter and AbstractMarshaller contain the processExternalEntities defense (default fa...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:f596c7ef-6bcb-556d-80a1-acc8b3b1bf2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability fix was already present in the upstream Spring Framework 4.2.9.RELEASE that TuxCare onboarded. The upstream commit 8e096aeef5 (authored by Rossen Stoyanchev from Pivotal) added NO_OP_ENTITY_RESOLVER defenses to all XML processing classes, blocking external entity resolution by default. All 5 affected files contain the fix: Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, and Jaxb2CollectionHttpMessageConverter. The processExternalEntities flag defaults to false, making the protection active out-of-the-box.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5e8fe5de-419a-5e44-820e-b02c127a718c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability is NOT present in Spring Framework 4.2.9.RELEASE-tuxcare.13. The fix (URL encoding of request URI in form action attribute via UriUtils.encodePath) was authored by upstream Spring developer Rossen Stoyanchev in commit 741b4b229a and shipped in the upstream 4.2.9.RELEASE before TuxCare onboarded it. The vulnerable pattern (unencoded requestUri in form action) does...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d74bf2c3-76e5-5b28-94f7-fcabb2996499", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 4.2.9.RELEASE-tuxcare.13. The vulnerability affected versions before 3.2.12, 4.0.8, and 4.1.2. The fix was introduced in Spring Framework 4.1.2, and the target version 4.2.9.RELEASE (released upstream in September 2016) already contained all security protections when TuxCare onboarded it in April 2026. Both PathR...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:4aa5c82e-f078-5b06-a5d4-6bbfd5706921", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5661532b-4273-5958-b993-5887e081a7f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.2.9.RELEASE is not affected by CVE-2020-5397. The vulnerable code pattern (CORS preflight detection without Origin header validation) never existed in the 4.x line. The Origin check was present from the original CORS implementation in Spring 4.2 (2015) and was never removed. The vulnerability only affected Spring 5.2.x versions where the code was refactored and temporarily lo...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a77f701d-1037-5733-af78-1f03d5f24286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:338fdf3f-570a-5283-89e7-0eac8049a1da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:63a5b2f9-da1c-58e2-9456-76d342982b8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:954744ba-b47c-5bed-af5e-f1cb3ed7a5cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.2.9.RELEASE is not affected by CVE-2023-34053. The vulnerability requires the observation/micrometer integration introduced in Spring Framework 6.0, which creates unbounded KeyValue objects for arbitrary HTTP method strings. This integration does not exist in version 4.2.9 (released 2016). While the target receives HTTP method strings via ServletServerHttpRequest.getMethod(),...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:1f0e9c0a-6893-5ffb-9fbd-7c15e1c20da8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5e0255e4-5239-5fd1-bb55-79ff77921dbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:35b15753-d8e0-5903-8c83-883b1cca1cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc, and is fixed in 4.2.9.RELEASE-tuxcare.15." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:99e8db85-a4af-53a8-966e-3bdef392ba89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5aac920b-9426-5e97-b572-fe8d3bfe8430", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d69facc4-599f-5cc9-863f-4aec2a1ca6df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7d83383f-f2ca-5326-85a8-59a45fface87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:f9ad231f-cc9c-5040-ad93-7376dbd1dba7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0ca07d9f-7b1c-598c-afbc-bd13dab7bd52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc, and is fixed in 4.2.9.RELEASE-tuxcare.15." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:92a1a95b-1b9f-5369-8ad1-5a3e00e860db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9d7b071d-a70e-5c6b-89af-f621437d14f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9a6e0db3-aff4-5354-854d-b3e3a6070ab4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b74f7382-7edf-5146-91dc-b043b8d0c07c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:38aea93e-abbe-5256-b8fd-df80517d0ed5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0bbb7802-be2f-50fc-bfa7-4c0db7451816", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:58912fcc-af04-579f-9159-d214f52263de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-47883 affects UrlHandlerFilter, a component that automatically redirects URLs with trailing slashes. The vulnerability allows open redirects via paths starting with '//' (protocol-relative URLs). However, UrlHandlerFilter was introduced in Spring Framework 6.2.0, and the target version 4.2.9.RELEASE-tuxcare.13 predates this by approximately 8 major versions. The vulnerable component do...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:05fadc1f-6158-5648-8b00-3f8bcb861636", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:478deb8c-ed1d-503f-94cd-6c772ba53230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b6a66dd5-7bfb-556b-84b3-484920d5f7b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.2.9.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:22915596-fa29-50ee-9ed8-b8703846d930", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks Spring MVC\u2019s functional web framework, including RouterFunction, ServerResponse and SseServerResponse, so the vulnerable execution path does not exist. Its available SSE implementation uses the annotation-based SseEmitter, whose string-data writer handles CR, LF and CRLF at spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java:239.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.12" } ] }