{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7cc556ee-ca14-5dce-a110-ebdc0197af17", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2", "version": "5.1.18.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.18.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53c70567-f1f1-51b1-915b-8fcae485abed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 5.1.18.RELEASE-tuxcare.1. The upstream fix was already included in Spring Framework 5.1.18.RELEASE before TuxCare onboarded the version. The defense code disables external entity resolution by default (processExternalEntities=false) and includes additional hardening (DTD disabling, NO_OP...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5c30d20e-fb12-568e-97c3-6b07d2137164", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is NOT present in Spring Framework 5.1.18.RELEASE. The upstream fix (commit 8e096aeef5 by rstoyanchev@gopivotal.com) was already included in the v5.1.18.RELEASE base version before TuxCare onboarded it. All XML processing components have XXE defenses: NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER return empty content instead of resolving external URIs. The processExternalEntities flag defaults to false across all converters (Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller). Additionally, Jaxb2CollectionHttpMessageConverter and XmlEventDecoder use StaxUtils.createDefensiveInputFactory() which disables DTD and external entity support by default. The vulnerable code pattern described in CVE-2014-0225 is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97c9e44e-aa28-5070-9170-3bb3e02f2cf2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 does not affect Spring Framework 5.1.18.RELEASE. The vulnerability was an XSS issue in FormTag.java where unencoded request URIs were reflected in form action attributes. The upstream vendor (Pivotal/VMware) fixed this in commit 741b4b229ae032bd17175b46f98673ce0bd2d485 on February 13, 2014, affecting versions 3.2.8+ and 4.0.2+. Spring Framework 5.1.18.RELEASE (released 2019) inher...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3f331199-81c7-5a94-8217-717e043c238f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2014-3625. The directory traversal vulnerability fix was already included in the upstream Spring Framework 5.1.18.RELEASE release. The security patches that prevent directory traversal in static resource handling (commit 9cef8e3001 and related commits) are present in the target codebase, having been shipped by the upstream vendor before Tux...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c05d5d53-f397-5cd8-9e2f-9022307d7b9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.1.18.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d647b164-a5a8-575f-a5fc-4fa3dac5f152", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.18.RELEASE-tuxcare.2 is NOT affected by CVE-2020-5397. The vulnerability, which affected versions 5.2.x prior to 5.2.3, allowed CSRF attacks via malformed CORS preflight requests (OPTIONS + Access-Control-Request-Method header without Origin header). The target version 5.1.18 has never contained this vulnerable pattern. The 5.1.18 codebase requires the Origin header check t...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd77ce64-474c-579f-a8ae-1e10016f8f2b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2020-5398 affects Spring Framework 5.1.x prior to 5.1.13. The target version is 5.1.18.RELEASE, which already contains the upstream fix (commit 6ce19ff86) that escapes quote characters in Content-Disposition filename attributes. The vulnerable code pattern is not present because the upstream vendor fixed it in 5.1.13, before this version was released and subsequently onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0dc06c30-a7be-56c2-89b2-327a3f927beb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0002ed30-a153-574a-907e-e9bb7419368d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9f48c37-a28a-5f86-8fe8-93b30fa1acca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Target Spring Framework 5.1.18.RELEASE does not contain the vulnerable observation/metrics infrastructure. CVE-2023-34053 affects the DefaultServerRequestObservationConvention class introduced in Spring Framework 6.0.0. The observation package and Micrometer integration do not exist in version 5.1.18, which predates this feature by several major versions. The vulnerability pattern cannot manife...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6dadf13-fcda-5e85-8ec4-2790b1e07a59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72a35e9f-2c34-5e8f-baf4-8c77ebc6aa22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:65cc42d8-afa7-5b95-8367-2fc637ea0353", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.18.RELEASE-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:014f350b-7688-5037-8ac1-497e444feac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:75f3bfd6-c20b-55c5-b1a6-393e294aab8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:21af1138-f753-589e-b19c-4ad9f9ce14bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fdfa7c1d-6fbf-5025-bd2e-e5bf411cf1f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0cd19d94-9b88-5ac6-b24e-5692e58377e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7546344a-8b04-51b6-9661-2e796d546386", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f335fcbe-3da1-51a0-a80f-3cc0a53bc349", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:efe6c518-64f5-50da-ba05-7b1356f08323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.18.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:becc7e5f-62d7-5859-9ab8-b8f3db49ea13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1bbde2b7-dda9-5067-b0c9-38d75f42ef8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7a814d97-a62f-5a18-9407-ed375f15dd8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:862b55dd-28b7-58cd-9330-0efaa57b75f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d2635d37-42c5-501f-9e4a-768ee4e04d6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version. UrlHandlerFilter was introduced to Spring Framework in May 2024, almost 4 years after version 5.1.18.RELEASE was released in September 2020. No alternative mechanism exists in version 5.1.18 that exhibits the same vulnerability pattern (taking request URIs...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f31a7ad3-a464-5893-b36d-8f955f22c51b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4788244-3fe9-54bc-a28f-d474119984bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c8723ec-22b7-55a8-93fc-857a0795393b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47890. The vulnerability requires the view fragments rendering feature with SSE, which was introduced in Spring Framework 6.2+. Spring 5.1.18 does not contain the Fragment class, fragment rendering infrastructure, or the vulnerable code patterns described in the patches. While 5.1.18 does support basic SSE through SseEmitter, it cannot render view fragments as SSE events, making the vulnerability inapplicable to this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eabc5d5b-0913-5441-9aaf-125330ef5aea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Version 5.1.18.RELEASE is not affected by CVE-2026-59313. The CVE explicitly requires \"Spring MVC's functional web framework (RouterFunction, ServerResponse.sse())\" as a necessary condition for vulnerability. This framework was introduced in Spring 5.2.0.M1 and does not exist in version 5.1.18. The directory spring-webmvc/src/main/java/org/springframework/web/servlet/function/ and the vulnerabl...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.18.RELEASE-tuxcare.2" } ] }