{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1b784af-6d70-50eb-9968-8f56c387cec4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4", "version": "5.2.8.RELEASE-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:12f01a4b-5c26-5fcc-be49-229d6c57613e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework before 3.2.8 and 4.0.0 before 4.0.2. The target is Spring Framework 5.2.8.RELEASE, which already contains the upstream fix for XXE in Jaxb2RootElementHttpMessageConverter. The fix was added by upstream commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 (author: rstoyanchev@gopivotal.com) in Feb 2014 and was present in the upstream 5.2.8.RELEASE that TuxCare o...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:6f9693a7-33c3-5c9e-a818-04c72a3baeea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. The target Spring Framework 5.2.8.RELEASE already contains the upstream fix for CVE-2014-0225. The fix (commit 8e096aeef5) was authored by Rossen Stoyanchev from the upstream Spring team and was included in the 5.2.8.RELEASE version that TuxCare onboarded. The fix installs no-op entity resolvers (NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER) that return empty content when processExternalEntities is false (the default), preventing XXE attacks. All XML parsing entry points in spring-web and spring-oxm modules are protected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:c073ab7a-7a36-5cdf-879a-09e0416ea98c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 5.2.8.RELEASE. The XSS vulnerability in FormTag's default action handling was fixed by the upstream vendor (Pivotal/VMware) in commit 741b4b229a, which added URI path encoding via UriUtils.encodePath() before inserting the requestUri into the HTML form action attribute. This fix was already included in the upstream Spring Framework 5.2.8.RELEASE ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:0cf32bbd-6873-5b8e-9533-2c0dbfa35e00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 5.2.8.RELEASE. The upstream fix (commit 9cef8e3001ddd61c734281a7556efd84b6cc2755 by rstoyanchev@pivotal.io, dated Nov 11, 2014) was already included in the upstream Spring Framework 5.2.8.RELEASE when TuxCare onboarded it. The fix adds comprehensive path validation including: (1) path normalization to remove lead...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:7f50ec1a-4801-5755-a511-f384ca1c979e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.2.8.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:bb07c735-9ae9-5760-9dee-473e247a8b34", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 is not present in Spring Framework 5.2.8.RELEASE. The vulnerability allowed CSRF attacks through CORS preflight requests (OPTIONS with Access-Control-Request-Method but missing Origin header) to reach application handlers. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) was included in Spring Framework 5.2.3 and is present in the 5.2.8.RELEA...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:39883e5e-7550-50ba-995d-00cc561f886c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 5.2.3.RELEASE, and version 5.2.8.RELEASE is a later release of the same line. Advisories: GitHub GHSA-8wx2-9q48-vm9r (fixed in 5.2.3.RELEASE), NVD (fixed in 5.2.3), CVE record (fixed in 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:479cb248-6e78-5d77-a09d-b22f7319d76e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:a5d8f94f-00b3-5c27-85f0-a6af0b95597f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:8ea75523-08c7-5bcf-8d38-4664536fd7ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation framework's DefaultServerRequestObservationConvention classes, which create unbounded KeyValue object allocations from arbitrary HTTP method strings. This observation framework was introduced in Spring Framework 6.0 (September 2022) and does not exist in version 5.2.8.RELEASE. The targe...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:9c9f4376-166f-5ed2-b4b0-f0b83f70b47c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:06af88ac-d80f-5fae-86fb-709302f72161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:0364bce6-c30e-5de1-a950-2297f5c274a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:e6b1a5b7-d51c-554d-900c-a38a4a9957fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:8f0f1a0d-53d4-5089-90e5-b983bd35c9f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:aa84ce88-4be8-5439-befe-948303de9903", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:438ea182-375e-5d9b-983f-3b3fcc7e0e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:a900faa0-2317-56d5-9e53-6b1358254f9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:f508bd30-1e38-5f11-b99d-ea91aa3e52d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:ca382f93-e8b4-57bf-ad6d-63b8308f0fba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:d1b34209-ed4f-5b38-a047-e4001d598e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:da7df0e7-bddb-5a5f-8000-df7191b82505", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:8e4a75cc-7dc8-5dae-89a0-748936e8493a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:d3f84e1f-90f7-5dbe-8b1d-2e6d136ffbc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:7d44afcd-bbec-5363-9562-d087340416fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:c54bf729-fd8b-526d-9e8b-666d563f7986", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) was introduced in version 6.2.0-M2 (May 2024) and does not exist in this version. The target version predates the feature introduction by approximately 4 years. No equivalent functionality exists in 5.2.8 that could exhibit the same open redirect vulnerability pattern.", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:2ab48b86-5138-5976-90d3-54fc23f73c65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:a5372ddb-cbc1-587e-8ced-23ca56e4e553", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:88b98577-b3a5-5d3f-bb6a-90f2e338defc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ], "bom-ref": "urn:uuid:bb9b8021-2651-5eb0-94bb-b2bcdabe05c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.8.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2026-59313. The vulnerability exists in the SseServerResponse class which implements ServerResponse.sse() for the functional web framework. This class and API were introduced in Spring Framework 6.2.0 (August 2024) and do not exist in version 5.2.8 (released June 2020). The CVE explicitly requires use of ServerResponse.sse(), makin...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.4" } ] }