{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e763464f-f0e7-5979-9136-26106664049c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7", "version": "4.3.25.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4bf881f7-989f-5fcc-af96-19808162eba5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 4.3.25.RELEASE. The vulnerability affected versions before 3.2.8 and 4.0.0 before 4.0.2. The target version 4.3.25.RELEASE already contains the upstream fix (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 from February 2014) that disables external entity processing by default. The processSource() met...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4564fcf0-8898-5fe4-a158-c54cb3628998", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is not present in Spring Framework 4.3.25.RELEASE. The upstream vendor (Spring Framework project) applied the XXE protection fix in commit 8e096aeef5 (authored by Rossen Stoyanchev) before the 4.3.25.RELEASE version was published. When TuxCare onboarded version 4.3.25.RELEASE, the fix was already present in all affected XML processing components. All five patched files contain complete XXE defenses: NO_OP_ENTITY_RESOLVER/NO_OP_XML_RESOLVER implementations that return empty content, external-general-entities SAX feature set to false, and processExternalEntities defaulting to false. The vulnerable pattern (unrestricted external entity resolution) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:50770315-616f-5817-a07c-23deba0622a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability was fixed in the upstream Spring Framework release before TuxCare onboarded version 4.3.25.RELEASE. The fix (commit 741b4b229a by upstream developer Rossen Stoyanchev) adds URI path encoding using UriUtils.encodePath() to prevent HTML/script injection when the form tag uses the default action. The vulnerable code pattern (unencoded request URI inserted into HTML)...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f42bad93-e4a2-5047-b8d8-bb9205044663", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 4.3.25.RELEASE-tuxcare.6. The security fixes from upstream commits 9cef8e3001 and related patches (SPR-12354) were already included in the upstream Spring Framework 4.3.25.RELEASE when TuxCare onboarded it in commit 15f8875037. The target contains all required defenses: processPath(), isInvalidPath(), isInvalidEn...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b3727aeb-f2af-5607-988e-beb48a112cc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. Spring Framework 4.3.25.RELEASE already contains the fix for CVE-2016-9878: ResourceServlet normalizes each requested resource URL with StringUtils.cleanPath before dispatching it, so path traversal sequences are removed (fixed upstream in 4.3.5).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:0b4dc6d5-b887-55db-91c8-c83964262a49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Target version 4.3.25.RELEASE is not affected by CVE-2020-5397. The vulnerability was introduced in Spring Framework 5.2.0 (April 2019) and fixed in 5.2.3 (January 2020). The target version 4.3.25 (August 2019) retained the original safe implementation where CorsUtils.isPreFlightRequest() checks for the Origin header via isCorsRequest(), preventing OPTIONS requests without Origin from being mis...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c8bc8faa-a9f6-5721-bbb8-ea7cafa2aa5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:61dbb039-4bf2-559b-8019-2a1c4a73874c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:24885b4c-7372-54dd-925f-ce41a4095cce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:24181a8c-028c-5535-9a14-29a9585016ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework 6.0.0-6.0.13 through a vulnerability in the observation/micrometer integration feature. Spring Framework 4.3.25.RELEASE does not contain this feature at all - the observation package was introduced in Spring Framework 6.0. While the target processes HTTP requests with method strings (the INPUT), there is no code path leading to unbounded observation tag a...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1442c501-26d0-524b-8d78-f9c93b659e80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:06c32d67-537f-504f-96dd-c826de42a906", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:0fa1e4a3-d915-549c-aec2-3d358e9c0f2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:0819bdc6-c577-5efe-b5f1-d524293f8ca7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a3a85b47-8aba-55b2-b8d9-ab83f3b7f1d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ce65e819-5f38-5a25-8cb5-ad729e94083d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f9e03723-7c6f-57cc-afab-fecc558f204e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4ceea42a-5284-5acc-af52-11d87f571204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a9a96f9e-1d9f-5230-a405-54b73e7ca456", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc, and is fixed in 4.3.25.RELEASE-tuxcare.8." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:76baae1c-e5ea-5ae1-b2ae-836dbb727388", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:22af5d56-9e8a-5fe9-83ce-f6fed4f2e2a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:76e7f3eb-b795-520f-81ca-4a525a2ebf83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e504ef5b-0bbe-5629-b7ff-ee791c79c0e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f15dc7d5-cce2-5bfa-89bf-be11156ef1d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:bc6910e0-5776-508c-a3f1-045b084d6414", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-41853. This version predates WebFlux (introduced in Spring 5.0) and lacks the vulnerable component entirely. The CVE specifically affects WebFlux's DefaultServerWebExchange class, which has a message reader selection mechanism that can be exploited via wildcard Content-Type headers (*/* or multipart/*) to cause inappropriate decoders t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e9c205da-01c4-5bcb-9299-6f911b811101", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced in Spring Framework 6.2.0 (May 2024), released approximately 8 years after the 4.3.x version line. No equivalent trailing-slash redirect functionality exists in version 4.3.25.", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c6afff3d-a71f-54a3-82d0-64bbfefb985a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a5bf9259-3fc3-5833-87ec-4c75ff905e52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:24acdb55-8c5f-5145-8650-4a4a62959570", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.25.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:480e31e8-0d8f-5211-99ed-1620811fccef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.25.RELEASE is NOT affected by CVE-2026-59313. The vulnerability targets Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()), which was introduced in Spring Framework 5.0 and does not exist in the 4.3.x line. The target repository contains only traditional Spring MVC components (spring-webmvc, spring-web) without the spring-webflux or functional web ...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.25.RELEASE-tuxcare.7" } ] }