{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3ccb1cd8-e711-5e25-a1d6-e4f64c809585", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2", "version": "5.0.0.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c66799d8-45a9-50d1-8cac-050c50ffb628", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 XXE vulnerability is NOT present in Spring Framework 5.0.0.RELEASE-tuxcare.1. The fix was already shipped in the upstream Spring Framework 5.0.0.RELEASE before TuxCare onboarded it. The Jaxb2RootElementHttpMessageConverter class contains the complete XXE defense: processExternalEntities flag (default false), processSource() method that wraps StreamSource with SAXSource using an XM...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e5988d0-a231-5ccd-a238-a7ed5de8af41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is NOT present in Spring Framework 5.0.0.RELEASE. The fix (commit 8e096aeef5, SPR-11768) was already shipped in the upstream 5.0.0.RELEASE before TuxCare onboarded it. All affected XML processing classes contain NO_OP_ENTITY_RESOLVER defense, enabled by default (processExternalEntities=false), preventing external entity resolution in DTD declarations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9725212f-4a72-5c71-9c1b-61f0288f5dd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework 3.0.0-3.2.7 and 4.0.0-4.0.1 due to missing URI encoding in FormTag when generating default form actions, allowing XSS via malicious URIs. Target version 5.0.0.RELEASE is not affected - the upstream fix (commit 741b4b229a by rstoyanchev@gopivotal.com) shipped in the upstream release before TuxCare onboarded it. The fix applies UriUtils.encodePath() to encod...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:321e3714-974e-508e-aba5-5b15c2055ad4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is not present in Spring Framework 5.0.0.RELEASE. The vulnerability was fixed by the upstream vendor (Pivotal/Spring) in version 4.1.2 (November 2014) through commits 9cef8e3001 and 161d3e3049, which added comprehensive path validation and resource location verification. Spring Framework 5.0.0.RELEASE (September 2017) includes all these fixes. The...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f83536b4-3b30-5ac5-8a04-b11bb548478f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.0.0.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2165d240-859b-5150-b4a0-29d03292cdb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because CORS preflight requests are intercepted before they can invoke application endpoints. MVC replaces the endpoint handler with a preflight handler at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/AbstractHandlerMapping.java:466. WebFlux returns a handler that completes without invoking the endpoint at spring-webflux/src/main/java/org/springframework/web/reactive/handler/AbstractHandlerMapping.java:135.", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:974b3049-ad22-5de0-a8c1-5ca871ee8408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:071207aa-d8e3-5024-ab9f-dd1ea645f34b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54891ae8-66ab-584b-bf53-a3fcd5c86c68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3178e6af-6010-5ac8-9d78-d5ce4275fe18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.0.RELEASE is not affected by CVE-2023-34053. The vulnerability requires the observation/Micrometer integration feature that creates KeyValue objects from HTTP method strings, which was introduced in Spring Framework 6.0.0-M6. This integration does not exist in version 5.0.0.RELEASE. The vulnerable code (DefaultServerRequestObservationConvention classes) and the entire obser...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:397b0757-2db3-517e-a56b-a15fb733ac8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:946e8398-b130-53a9-b3e2-5fd8c675c203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12f4e6c0-9747-5a47-839c-10be020f2c78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c9ef71f4-7aa6-5624-b80d-217d869de352", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3f37f8c9-43c1-5bea-a1f6-2852e140e491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b8cba773-c546-5a67-86a7-bc2a3cb17a64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8856d4a3-92dc-5eed-9bfa-495e82774e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4f28d992-f0b3-5f54-94c8-9367f6066d14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:34431d3f-53b7-50c7-8076-ebc03003ad31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4131cd7a-b456-5070-8018-2b524712e881", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f56f5ddb-57cf-5093-a25d-db465e740e03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73860944-314d-503c-a0c1-e956a122c0dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8f89366c-d346-5057-97b4-75dff5984ba4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:386d592b-0c65-513e-a602-7c52ff8055c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9294d815-9e56-54c8-abbd-7b42b8bf5f1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:491035f4-facf-5758-aef4-3092a93e4067", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.0.RELEASE does not contain the vulnerable UrlHandlerFilter component. This class was introduced in version 6.2.0-M2 (May 2024), approximately 7 years after 5.0.0.RELEASE (September 2017). While the framework processes HTTP request URIs and has redirect capabilities, no code path exists that implements the vulnerable pattern of pattern-based request interception combined wit...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f006398b-adf4-5bcf-a992-d0b9c680f186", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53c31c59-802e-5f29-9e25-555ab7a55037", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f0340ac-9cea-57a3-a828-442a4fdbe43d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Target version 5.0.0.RELEASE does not contain the vulnerable Fragment rendering feature. CVE-2026-47890 affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8, where a new SSE Fragment rendering feature improperly escaped carriage returns in view content. This feature was introduced in Spring Framework 6.2.0 (August 2024, commit 8e2b27e5d8). Version 5.0.0.RELEASE predates this feature by approximately 7 years and lacks the vulnerable code paths entirely. The base SseEmitter implementation in 5.0.0 already correctly handles all newline types (\\r, \\n, \\r\\n) in its writeStringData() method (SseEmitter.java lines 245-268), using the same logic as the patch fix. The vulnerability was specific to the later-added Fragment rendering code path that used a simplified text.replace(\"\\n\", \"\\ndata:\") approach.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6659bdf-f362-5534-a213-1b18455651cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.0.0.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-59313 targets a vulnerability in Spring MVC's functional web framework (ServerResponse.sse() in SseServerResponse.java), where incomplete line separator escaping allowed SSE stream injection via \\r or \\r\\n characters. This vulnerable code path does not exist in Spring Framework 5.0.0.RELEASE. The SseServerResponse class and Spring MVC functional web framework (spring-webmvc/src/main/ja...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.0.RELEASE-tuxcare.2" } ] }