{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec76772d-a85b-5dc6-8bbc-12388604115c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2", "version": "5.1.7.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e9c1bf65-1fe4-5850-b7b5-644901a83584", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 concerns XXE (XML External Entity) vulnerability in Jaxb2RootElementHttpMessageConverter. The target Spring Framework 5.1.7.RELEASE contains the upstream vendor fix (commit edba32b309) that disables external entity processing by default. The fix was authored by upstream Spring developers (rstoyanchev@gopivotal.com, pwebb@gopivotal.com) and was already present in the 5.1.7.RELEASE ...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:743f0c8e-fdc1-5466-813d-3dcf37e2d14d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is NOT present in Spring Framework 5.1.7.RELEASE-tuxcare.2. The upstream vendor (Spring team) already fixed this vulnerability in commit 8e096aeef5 by Rossen Stoyanchev, which was included in the upstream 5.1.7.RELEASE that TuxCare onboarded. All XML parsers disable external entity resolution by default (processExternalEntities=false) and install NO_OP_ENTITY_RESOLVER to prevent XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:375a7d2f-e88b-5c4f-a1f2-58d1fb62cde4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The target version 5.1.7.RELEASE already contains the upstream fix (commit 741b4b229ae032bd17175b46f98673ce0bd2d485 by Rossen Stoyanchev) that encodes the request URI before inserting it into the form action attribute. The fix was already present in the upstream 5.1.7.RELEASE when TuxCare onboarded it (onboarding ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1d18980a-b1fc-5b84-9a7f-6c2fc4230ae1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Target version 5.1.7.RELEASE is NOT AFFECTED by CVE-2014-3625. The directory traversal vulnerability in static resource handling was fixed by the upstream Spring Framework team in November 2014 (commit 9cef8e3001) and shipped in the 5.1.7.RELEASE version that TuxCare onboarded. All defense mechanisms from the patch are present: path validation with control character stripping, traversal sequenc...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82dc55f2-194f-542e-9493-46b27c0b89e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.1.7.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b7359cd-598b-5ec2-aae0-f6bccbad2372", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.7.RELEASE is not affected by CVE-2020-5397. The vulnerability was introduced as a regression in version 5.2.x when CORS handling was refactored. In 5.1.7.RELEASE, the `CorsUtils.isPreFlightRequest()` method already includes Origin header validation via the `isCorsRequest()` call, preventing OPTIONS requests without Origin from being incorrectly identified as CORS preflight ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd832123-7aef-5be6-ad5b-47c1754ab56e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.7.RELEASE-tuxcare.3." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8fb0ace0-9066-5ff7-a54f-50530966f654", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae7130d7-24a6-5f44-8033-a72766908f9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:09198622-2bee-57e9-adc5-29b3b4ed2fb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework versions 6.0.0-6.0.13 through unbounded KeyValue allocations in observation conventions. The target version 5.1.7.RELEASE is NOT AFFECTED because the entire observation API infrastructure (DefaultServerRequestObservationConvention, ServerRequestObservationContext, ObservationRegistry) does not exist in this version. The observation API was introduced in S...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:47bb59f9-3b16-5152-a0eb-04a0e6ca6d85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:47bd4c51-d069-54bf-8919-1042ac2658f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c32f2e0-aac0-5acb-8e63-6bd7e2843b9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ab4e3c3-0710-5471-9f92-fc026adb9dec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea122f75-c3fc-567d-b201-8473d4ee6e66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:053c9264-97ed-5c7b-8b23-e15882ac4fa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0fe6c448-9ae5-5087-943b-283b339fb59d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0c835ed-34de-568e-8f59-271e3e985445", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:873c40db-cda3-536f-86ec-3eac65bb44e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.7.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f018cee5-164a-5c4f-be79-9bb6f7501a91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.1.7.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f292b37d-e07a-515f-8f81-32e0e0e0929f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d81916c-b0c3-59c7-8622-4fe9e2da6ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0210f50e-189b-5c51-941b-24d9853130dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6c76ce00-fa98-53d6-9985-747791a0b730", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d35e459a-a028-5ddd-bf8e-a748e2fc0840", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af64bd63-f76e-5e11-a0ad-2f32dfd8bc3d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.7.RELEASE is not affected by CVE-2026-47883. The vulnerable component `UrlHandlerFilter` does not exist in this version - it was introduced in Spring Framework 6.2.0-M2 (May 2024), years after the 5.1.7 release. While the target processes HTTP requests with URIs (the Brief's INPUT), no code path exists that takes raw request URIs and uses them directly as redirect Location ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:21db9341-fc15-5b9e-b775-4e0c81b4d9f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:356748d0-1f59-52dc-a95d-49909c4c335b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b64d6367-2368-5f4a-b3f8-bdfff387f1d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.1.7.RELEASE is not affected by CVE-2026-47890. The vulnerability exists in the SSE (Server-Sent Events) view fragment rendering feature, which was introduced in Spring Framework 6.x in August 2024 (commit 622c1b9e8c). This feature does not exist in version 5.1.7 released in 2019. The vulnerable code paths that render view fragments over SSE (ViewResolutionResultHandler and ResponseBodyEmitterReturnValueHandler with Fragment support) are completely absent from this version. TuxCare has appropriately backported CVE-2026-47890 only to Spring Framework 6.2.x versions (6.2.1, 6.2.3, 6.2.5, 6.2.12-19), confirming this CVE does not apply to 5.1.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f00e8ab9-40ef-53de-9be5-476e6fd1e5fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-59313 does not affect Spring Framework 5.1.7.RELEASE because the vulnerable component (Spring MVC functional web framework with RouterFunction and ServerResponse.sse()) does not exist in this version. The CVE explicitly requires \"the application is using Spring MVC's functional web framework\" as a prerequisite condition, and this framework was introduced in Spring 5.2+. While the targe...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.7.RELEASE-tuxcare.2" } ] }