{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:beaad95e-f9a9-5666-8aed-e779a84be273", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2", "version": "5.3.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.3", "type": "library", "group": "org.springframework", "version": "5.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e0f5ed7d-4ce6-5191-9802-c8202aafe8dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT affecting Spring Framework 5.3.3. The upstream fix (commit edba32b309 by rstoyanchev@gopivotal.com) was already present in the Spring Framework 5.3.3 release that TuxCare onboarded. The fix adds a processSource() method that sets SAX feature \"external-general-entities\" to false by default, blocking external entity resolution and...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d8775cd0-3ba6-5243-b3cb-2389ccea805a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.3.3 is NOT affected by CVE-2014-0225. The XXE vulnerability fix (disabling external DTD entity resolution via NO_OP_ENTITY_RESOLVER) was added to the upstream Spring Framework in May 2014 (commit 8e096aeef55 by Rossen Stoyanchev) and was already present in the 5.3.3 release that TuxCare onboarded. All affected XML processing classes (Jaxb2Marshaller, AbstractMarshaller, Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter, Jaxb2CollectionHttpMessageConverter) have the fix enabled by default with processExternalEntities=false.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ace0fb51-f1f3-5040-b25f-2bd107ce6871", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 (XSS via unencoded request URI in form action) is NOT present in Spring Framework 5.3.3. The fix was authored by Rossen Stoyanchev (rstoyanchev@gopivotal.com) in upstream commit 741b4b229a and was already included in Spring Framework 5.3.3 when TuxCare onboarded that version. The vulnerable pattern (unencoded request URI in form action attribute) does not exist because UriUtils.en...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3d55ee44-0932-5d18-a538-4f149dc092e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.3 is NOT affected by CVE-2014-3625. The vulnerability (directory traversal via crafted static resource paths) was fixed by upstream Pivotal in November 2014 (commit 9cef8e3001). This fix shipped in Spring Framework 5.3.3 (released January 2021), over 6 years later. TuxCare onboarded version 5.3.3 which already contained the complete upstream fix. The target has all four def...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:b4525024-bcd6-5760-bde0-5a38b66d9c52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.3 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8ef113d7-599b-54a3-acef-ce712a2c8ef2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Target Spring Framework 5.3.3 is not affected by CVE-2020-5397. The vulnerability was fixed in upstream Spring 5.2.3 (released January 2020) before version 5.3.3 was released. The fix commit bc7d010485 by sdeleuze@pivotal.io adds Origin header validation to CorsUtils.isPreFlightRequest(), preventing malicious OPTIONS requests without Origin headers from being treated as valid CORS preflight req...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4fee82c8-b6eb-5f5f-a2d2-f0ff93470161", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.3.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:78dcb480-1b50-5f67-abb0-2702ea277306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.3.3-tuxcare.4." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:33d072bf-6b9b-52c4-a5d1-c68f1cc0209c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.3.3-tuxcare.5." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0e8011fc-fe2c-53a3-8e01-4204c3d500f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 does not affect Spring Framework 5.3.3. The vulnerability exists in the observation framework (org.springframework.http.server.observation package) which was introduced in Spring Framework 6.0. Version 5.3.3 predates this feature and does not contain any observation code, ObservationRegistry integration, or Micrometer KeyValue allocation patterns related to HTTP request processin...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:cae7f0f8-1a6a-51ce-b5e4-caaa05709f03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ef2402a5-58f6-5e10-bc08-0efa0dda9071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8e22174e-3686-5420-967e-bdb3cdedb668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9d7caab4-0d7d-537a-8248-09c498a5b2df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:36adaaaa-3922-5cd2-b6b3-5e90fd6982cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:6e0fdbab-3148-5baa-9753-4508f4d7635a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:890b1169-189e-5b8d-8aea-c34421ea4cbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a5d493e5-31bd-5a71-b166-2992a116ea33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:75d4bf14-cbda-5e47-818e-3851eac3c38a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:49529b78-c9b7-587f-a1f2-a7f7b4d9b4c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:154d03d4-97ee-5952-83da-fa999123510b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.3.3-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3d7a9ef1-7f52-5627-a50a-c6bbe944da90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:78fdf3b9-fbc5-5e4c-938e-9f42b2bf4f0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.3.3-tuxcare.4." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:66b5acb7-a2c5-510b-8286-854daef353d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5c9f30eb-ce97-50bb-af4a-65c583edb1cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a528f7f0-1c33-5cb9-a05f-80581e5c0f93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2026-47883. The vulnerable UrlHandlerFilter class was introduced in Spring Framework 6.2.x series (first added May 15, 2024, in commit edb6bb717d). Since version 5.3.3 predates this feature entirely, the vulnerable code does not exist in the target repository. This is a clear case of Type A1 (input handler absent) - the class that handles URL redire...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e24b04b9-e5a8-53c8-b46b-71c97547a051", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:6f9b12a9-d6ee-5e00-9ccd-affc742acb7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e1de93e7-bd44-5ac1-a8ed-53bddbb91785", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.3.3 is not affected by CVE-2026-47890. The vulnerability concerns improper line break escaping in SSE view fragment rendering, a feature introduced in Spring Framework 6.2.x (August 2024). Version 5.3.3 predates this feature entirely - the Fragment API, FragmentsRendering, and view fragment rendering for SSE do not exist in this version. While 5.3.3 has general SSE support via SseEmitter, it properly escapes line breaks for string data and lacks the vulnerable view fragment rendering code path.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ], "bom-ref": "urn:uuid:b755f633-216b-5fa2-888a-b6c2fd7951ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.3-tuxcare.2" } ] }