{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c7ce2530-566a-5dff-9217-e7cf66025936", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2", "version": "5.1.13.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3770b19-6245-541e-a774-1da14a562f49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 5.1.13.RELEASE. The upstream vendor fix was already included in the 5.1.13.RELEASE version that TuxCare onboarded. The fix disables external entity resolution by default (processExternalEntities=false) and configures XMLReader to block external-general-entities, preventing XXE attacks. F...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5e67b39-69b1-5db1-8ecc-0ed9193cab7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability in Spring Framework XML processing) is NOT present in the target version 5.1.13.RELEASE. The upstream fix (commit 8e096aeef5 \"Disable URL resolution in DTD declarations\" by Rossen Stoyanchev) was shipped in Spring Framework v4.1.0.RC1 (May 2014) and is present in all subsequent versions including 5.1.13.RELEASE. All affected XML processing classes (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) contain NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER implementations that return empty content instead of resolving external URIs in DTD declarations, preventing XXE attacks. The fix was authored by the upstream vendor (Pivotal/Spring) and was already in the upstream release when TuxCare onboarded version 5.1.13.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c8c8bc79-872a-579d-8d22-6ef263874b0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework versions 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The target is Spring Framework 5.1.13.RELEASE-tuxcare.1. The vulnerability (XSS via unencoded request URI in form action attribute) is NOT PRESENT because the upstream fix was already included in Spring Framework 5.1.13.RELEASE before TuxCare onboarded it. The fix (commit 741b4b229a by rstoyanchev@gopivot...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:45e09ea8-706c-5808-b830-41f82e6fbbfd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is NOT present in Spring Framework 5.1.13.RELEASE-tuxcare.1. All security fixes for the directory traversal vulnerability were already included in the upstream Spring Framework 5.1.13.RELEASE that TuxCare onboarded. The fix commit (9cef8e3001) by upstream author rstoyanchev@pivotal.io predates the first TuxCare commit (b3606223d9 \"Onboard version 5.1.13.RELEASE\") and is an ancesto...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9324566-420a-5e1e-a304-0d7cd1c08c7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.1.13.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:94f2d78b-8b1c-5fd6-a25a-b303a78387c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 The target version 5.1.13.RELEASE is not affected by CVE-2020-5397. The vulnerability pattern (missing Origin header check in isPreFlightRequest) that affected Spring Framework 5.2.x prior to 5.2.3 is not present in 5.1.13. The target version already includes the defensive Origin header check via isCorsRequest() that was removed in 5.2.x and later re-added in the 5.2.3 fix. The vulnerability wa...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89f97cf0-053a-5b87-ae22-6d73985ab268", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. The target Spring Framework 5.1.13.RELEASE-tuxcare.2 is NOT affected by CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition header). The vulnerability was fixed in upstream Spring Framework 5.1.13.RELEASE before TuxCare onboarded this version. The fix escapes quote and backslash characters in filenames before inserting them into Content-Disposition headers, preventing header injection attacks. The protection is present in the current code via the appendName() method at ContentDisposition.java:414-428.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96c917b9-a97d-5bb1-9ae1-f681928d9313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f40dd349-52f0-5cd7-b433-658509fc4a97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95d20d45-e7bd-530c-8f68-ac61e64057b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the Observation API (DefaultServerRequestObservationConvention classes) which was introduced in Spring Framework 6.0. This feature does not exist in version 5.1.13, making the vulnerability pattern impossible to manifest. The entire observation package, Micrometer integration, and ObservationRegistry ...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b57ed040-ad27-53ee-96d0-7c741ec8e4f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:08fd853a-78d9-584e-8a46-58de7504cc7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e669dca1-9321-59bb-951c-ebd137f61899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.13.RELEASE-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e7d50aa-ed4c-5c4b-9dd9-dc05885f5d3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52cdd580-1c85-5166-96a8-dfa6d37393fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2bcdf80b-df9a-5951-87a3-f28b3973303e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e9d85a79-9555-50bf-874d-eca8172a13ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53395208-3338-5e53-b6fd-269869cc1c4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a6cee03-08fb-58dc-811e-2c656b591705", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ecade6f-e250-5061-8373-2fcd1fc22b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d9379d38-46e8-502b-a252-992ea98f9ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.13.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dd540ebd-20c3-5c7e-a2fd-8f7c33c36250", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f98aad10-eebe-5cf3-91be-69aa60c0d2c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce1969f7-bc2a-51c0-846f-d0c891997333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d28edceb-3095-5d19-95e3-813aa7e161fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5bcc1cad-37ca-5ab9-8863-1ab0d637789e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-47883 affects Spring Framework's UrlHandlerFilter class, which is vulnerable to open redirect attacks when configured with broadly matching patterns (e.g., /**) and requests contain double leading slashes (//example.com). However, Spring Framework 5.1.13.RELEASE does NOT contain the UrlHandlerFilter class - it was introduced in version 6.2.0. The vulnerable component simply does not ex...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98fe5670-5db9-5ef3-9d95-12f43d0248e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:641783ad-242f-5d09-bb82-c54a7fa2ac72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1921b0d9-f952-5998-8685-f1afd32b96f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 5.1.13.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c9c6ceb7-a70b-53dd-9a15-84fc836feec9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2026-59313. The CVE explicitly requires \"Spring MVC's functional web framework (RouterFunction, ServerResponse.sse())\" as a mandatory precondition. This functional web framework (web.servlet.function package) does not exist in version 5.1.13 \u2014 it was introduced in Spring 5.3+. All TuxCare backports for this CVE (applied to 5.3.x versions) e...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.13.RELEASE-tuxcare.2" } ] }