{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c2c2206-6674-53ea-a38d-410d12e5b2aa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1", "version": "5.1.19.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.19.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f00b4f5e-4b1a-57a1-a698-1ef12ee8cc25", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.1.19.RELEASE is NOT AFFECTED by CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter). The upstream Spring Framework release already contained the complete fix: processExternalEntities disabled by default, processSource() method applying SAX security features to disable external-general-entities, and NO_OP_ENTITY_RESOLVER blocking entity resolution. The fix w...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4a9b36a0-0f14-5ec4-9cbf-ef230cce9edd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 5.1.19.RELEASE is not affected by CVE-2014-0225 (XXE vulnerability). The upstream fix was applied in May 2014 by Rossen Stoyanchev (commit 8e096aeef5) to versions 3.x and 4.x, and is present in all Spring Framework releases since then, including 5.1.19.RELEASE. All affected XML processing classes have NO_OP_ENTITY_RESOLVER/NO_OP_XML_RESOLVER implementations that prevent external entity resolution by default (processExternalEntities=false). The vulnerable pattern described in the CVE does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05c16a23-26ca-59da-90ec-f862761be956", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 5.1.19.RELEASE. The upstream fix (commit 741b4b229a by Rossen Stoyanchev) was already included in the upstream 5.1.19.RELEASE that TuxCare onboarded. The vulnerable pattern (unencoded request URI in form action attribute) was removed by the upstream vendor before TuxCare's involvement. The fix encodes the request URI using UriUtils.encodePath() a...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:046c5110-e509-52ee-a1b4-925275c81c00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2014-3625 because the upstream fixes (commits 9cef8e3001 \"Apply extra checks to static resource handling\" and 161d3e3049 \"Fix location checks for servlet 3 resources\") were already included in the release before TuxCare onboarded it. The fixes introduce multi-layered path validation: processPath() normalizes paths removing control chars, is...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d8aba944-05ba-5df5-b43b-9c4c86c66d3d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.1.19.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3a2eb886-7dca-5912-b5e1-a3de9d0e1d45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.19.RELEASE is NOT AFFECTED by CVE-2020-5397. While the CVE affects versions 5.2.x prior to 5.2.3, the 5.1.x line uses a different architectural implementation that has always required the Origin header before processing any CORS requests. The vulnerability pattern (processing preflight requests without Origin header validation) cannot manifest in 5.1.19 because the isCorsRe...", "justification": "protected_at_runtime" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:89cb66cb-9181-5b97-94fa-1f51aa150549", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download via Content-Disposition header injection) is NOT present in Spring Framework 5.1.19.RELEASE. The fix was authored by upstream Spring maintainer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 6ce19ff861 and shipped in Spring Framework 5.1.13. Version 5.1.19.RELEASE naturally includes this fix. The appendName() method (ContentDisposition.java:414-428) properly escapes double-quotes and backslashes in filenames, preventing quote-breakout attacks. TuxCare onboarded the already-fixed upstream release via commit d8956144e0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:85143bea-37d3-5f98-a358-c377b00395de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64ec28e2-39d4-5e0e-8eaa-2c545a24e959", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6126dc9c-13d6-515e-9919-700a221a494e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2023-34053. The vulnerability requires the observation API with micrometer integration, which was introduced in Spring Framework 6.0.0. The target version (5.1.19) predates this feature entirely. In 5.1.19, HTTP method strings are safely handled by HttpMethod.resolve() using a fixed-size static map that returns null for non-standard methods...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d2645050-3d85-5336-a48f-125c11e16d2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b88e6e24-f91f-5872-a20f-e1398fbc8b62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6e5913ed-72d3-5392-af64-da431015eda0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.1.19.RELEASE-tuxcare.5." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9a264152-1aa3-540f-8c10-4a3a52e75ebc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e4325709-1dcb-5953-95d7-3aef410c61a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da49e61a-5bc2-5143-8910-d5bd0b7bc335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:88ddb86e-bd43-5ff1-a63c-2a723608b100", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bd58c1bd-af8d-5d34-8990-efe3e4b92948", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:858ea164-914e-5c3d-9123-9a2a2516ca22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.1.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d088a42-3c8b-50e5-a3c7-d8bd5bc0533d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.1.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07889499-8318-5e67-8073-64e44129c532", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.1.19.RELEASE-tuxcare.5." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ca106f95-0dde-5a73-a170-b917a3ffd1fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1f5f6e5e-1ae3-59d2-b6f3-2aded303f4f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6deacfa0-cfae-5339-9311-fea5c62d0c39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ca853254-8497-5c2d-ab61-cbccd600cc7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0a2149ea-6eb1-506e-a02c-b88524d9bed2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2026-47883 because the vulnerable UrlHandlerFilter class does not exist in this version. UrlHandlerFilter was introduced in version 6.2.0 (May 15, 2024), which is significantly later than version 5.1.19. The target version predates the introduction of the vulnerable component by several years, making the vulnerability not applicable.", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:646eda10-da48-5216-8241-3cf9aca3bb0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a700c856-afd8-585f-981c-eb1bc9796fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:381f923f-80d3-517e-a692-c002e6ff0b4c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 5.1.19.RELEASE is NOT AFFECTED by CVE-2026-47890. The vulnerable SSE view fragment rendering feature does not exist in this version. This feature was introduced later in version 6.2.0-M7 (commit 6e55e78b22, July 2024). Version 5.1.19.RELEASE predates this functionality by several major versions. Without the SSE view fragment feature, the vulnerability pattern (improper escaping of carriage returns in rendered view content sent over SSE) cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:37c33c1e-b6a5-5ba5-b3a7-e6e63aef6f0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-59313 specifically targets Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()), which was introduced in Spring Framework 5.2. Version 5.1.19.RELEASE predates this feature and does not contain the vulnerable component. Exhaustive searches confirmed the absence of the spring-webmvc/function directory, RouterFunction interface, and SseServerResponse class. TuxCare...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.19.RELEASE-tuxcare.1" } ] }