{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1d1be9e3-e9a9-549c-9721-2d201d55a022", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11", "version": "5.2.13.RELEASE-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:f97df971-89b0-523c-8fd0-2de8b73f4949", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 5.2.13.RELEASE) is NOT AFFECTED by CVE-2014-0054. The XXE vulnerability in Jaxb2RootElementHttpMessageConverter was already fixed in the upstream Spring Framework release before TuxCare onboarding. The fix (commit edba32b309 from Feb 2014) disables external entity resolution by default through the processExternalEntities property and NO_OP_ENTITY_RESOLVER...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:bfa3a763-790d-50fa-9616-f7ba87fec79c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability via unrestricted DTD external entity resolution) is NOT present in Spring Framework 5.2.13.RELEASE. The upstream fix (commit 8e096aeef5, May 2014) was already included in the 5.2.13.RELEASE that TuxCare onboarded. All XML processing entry points (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) have NO_OP_ENTITY_RESOLVER or use StaxUtils.createDefensiveInputFactory() with NO_OP_XML_RESOLVER, preventing external entity resolution by default (processExternalEntities=false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:3833a74d-9709-5692-9667-d66d131da8a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 5.2.13.RELEASE. The XSS vulnerability in FormTag's default action handling was fixed in upstream Spring Framework v3.2.8 and v4.0.2.RELEASE (commit 741b4b229a). The fix, which adds URI encoding via UriUtils.encodePath() before outputting the request URI as the form action attribute, is present in the target codebase and shipped with the upstream ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:5503f25c-29fc-5c78-977f-76be692d2b13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 5.2.13.RELEASE. The comprehensive fix was already included in the upstream Spring Framework 5.2.13.RELEASE that TuxCare onboarded. The target contains all defensive mechanisms: processPath() removes control chars/leading slashes, isInvalidPath() rejects WEB-INF/META-INF/URL schemes/../, isInvalidEncodedPath() val...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:6820d55f-b526-5ad3-9cf8-e46c23e67f27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.2.13.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:17f8e282-a876-57c0-822b-44c2f7461daa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Target Spring Framework 5.2.13.RELEASE is NOT affected by CVE-2020-5397. The vulnerability affects versions 5.2.x prior to 5.2.3, and the fix was already present in the upstream 5.2.13.RELEASE that TuxCare onboarded. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) was shipped in Spring Framework 5.2.3 and is present in the target version. All key fix comp...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:1f6d1379-65dc-5d97-aa61-143e634b3706", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. The target Spring Framework 5.2.13.RELEASE is not affected by CVE-2020-5398. The vulnerability affects versions 5.2.x prior to 5.2.3, and the target version (5.2.13) already contains the upstream fix that escapes quote characters in Content-Disposition header filenames. The fix commit 41f40c6c by upstream author rstoyanchev@pivotal.io was included in the upstream 5.2.13.RELEASE before TuxCare's onboarding, implementing quote/backslash escaping in the appendName() method (lines 432-446 of ContentDisposition.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:77652c60-78e1-565f-84e5-fbc1ca45cded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:0c3e681e-bb9b-5745-b5f3-16c0f6f43c33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:a683b0cb-cafe-51d1-bc66-aede16e2fa0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.13.RELEASE is not affected by CVE-2023-34053. The vulnerability affects Spring Framework 6.0.0 - 6.0.13 and specifically targets the observation feature with Micrometer integration introduced in version 6.0.0. The target version (5.2.13.RELEASE) predates the observation feature entirely and does not contain any of the vulnerable code paths (DefaultServerRequestObservationCo...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:6d6ad550-6942-5de8-91f1-752fea57b011", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:179f9193-2d78-5b91-acf0-8f636055a184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:eb95d0b5-706f-53e1-a6e8-5a2fc640efb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:02035be1-6c01-58d9-927d-45d407a6f8f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:2ea22617-6c4f-591f-a417-b9e7724b4900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:6ed3839f-228a-5f82-9a9a-cb6b99a8163a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:12723f94-5ad4-59a0-aefd-0064ead6dcd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:7d7665bf-4921-5dfc-9bfe-677b9110040a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:713cb71a-a35f-5a21-843c-6f3ecbe01d47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:c220996a-bd05-5ecb-989b-c4c37c466101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:2262058c-9fa9-5910-9ad7-11f71d89bc61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc, and is fixed in 5.2.13.RELEASE-tuxcare.12." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:3a3cc831-1d9e-543f-a24e-3b32e1e7c9b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:4c0cd2f8-8689-51e4-85db-cde336a756f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:56f14672-984c-5075-9ba0-e0e3d9e729c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:f6fe81df-c82e-5805-b4b9-4b04ccc3bfc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later.", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:8456bfc9-fd1c-528c-beeb-9567432323e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-47883 affects UrlHandlerFilter, a component introduced in Spring Framework 6.2.0 (May 2024). Target version 5.2.13.RELEASE (released ~2020) predates UrlHandlerFilter by approximately 4 years. The vulnerable component and its automatic trailing slash redirect functionality do not exist in this version. While the target processes HTTP request URIs (input present), no code path exists tha...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:be488fac-216f-580c-8e94-3fb233c12424", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:0e466667-c4fc-513a-bfec-7bdcc84a4837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:d3d54642-5a8e-541d-bd91-7ecd79b00938", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. Spring Framework 5.2.13.RELEASE-tuxcare.11 is not affected by CVE-2026-47890. The vulnerability requires the Fragment view rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.x and 7.0.x and does not exist in version 5.2.13. The target version has basic SSE escaping already protected via CVE-2026-22735 fix, but lacks the vulnerable Fragment rendering code path entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ], "bom-ref": "urn:uuid:0615e719-1759-509c-a8df-8d3c488e723e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.2.13.RELEASE-tuxcare.11 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the MVC functional SSE API and SseServerResponse implementation required by this vulnerability. The response API provides ordinary bodies and rendering, with no ServerResponse.sse() entry point (spring-webmvc/src/main/java/org/springframework/web/servlet/function/ServerResponse.java:356).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.13.RELEASE-tuxcare.11" } ] }