{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:628c3c45-bb92-5c3e-91db-6453702dadff", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4", "version": "6.0.15-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.15", "type": "library", "group": "org.springframework", "version": "6.0.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:f4967bd3-88b1-5c6f-9e02-4e7edd518a8e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 XXE vulnerability is NOT present in spring-framework 6.0.15-tuxcare.5. The upstream Spring Framework already fixed this vulnerability in versions 3.2.8+ and 4.0.2+ (released in 2014). The target version 6.0.15, released in 2023, includes the comprehensive fix that was shipped in the upstream release before TuxCare onboarded it. The Jaxb2RootElementHttpMessageConverter class has pr...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:01ff1895-f17c-582a-89c7-d15bbe9c32da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.0.15 is NOT affected by CVE-2014-0225 (XXE vulnerability). The upstream fix commit (8e096aeef5) was already present in the Spring Framework 6.0.15 release before TuxCare onboarding. All XML processing entry points have comprehensive XXE protections: external entity resolution is disabled by default (processExternalEntities=false), NO_OP_ENTITY_RESOLVER is installed, and the external-general-entities SAX feature is disabled. The vulnerable pattern (unrestricted external entity resolution in DTD declarations) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:398e01b2-f261-55e3-addd-806c1818b937", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 6.0.15. The XSS vulnerability in FormTag.java's default action handling was fixed in upstream commit 741b4b229a (February 2014) by adding URI path encoding via UriUtils.encodePath(). This fix was already included in the upstream Spring Framework 6.0.15 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the onboard...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:874664df-c3fe-575b-af38-bb48ca9762f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 affects Spring Framework 3.0.4\u20133.2.11, 4.0.0\u20134.0.7, and 4.1.0\u20134.1.1. The target is Spring Framework 6.0.15-tuxcare.5, which already contains the upstream fix from November 2014 (commits 9cef8e3001 and 161d3e3049). The defense mechanisms (processPath, isInvalidPath, isInvalidEncodedPath, checkResource, isResourceUnderLocation) are present and active in the target's ResourceHttpRequ...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:0859879a-6f49-58b7-8943-9c08d146c4b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.0.15 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:9fa08961-630e-5a70-ab62-67047822b4c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x < 5.2.3 where CORS preflight requests could bypass validation and potentially enable CSRF attacks on non-authenticated endpoints. The vulnerability allowed OPTIONS requests with Access-Control-Request-Method header (but without Origin header) to reach endpoint handlers without CORS processing. The fix (commit bc7d01048579430b4b2df668178809b63d3f1929 ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:9d50ba50-b42c-5c5d-a974-b02fbeb61cf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:e5131d9e-3d8c-50a3-924f-357f70dafae2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.0.15 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:b6420077-9c48-53b2-a531-1e45c59dcfea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. CVE-2023-20860 is not present in Spring Framework 6.0.15. The vulnerability affects versions 6.0.0-6.0.6 and 5.3.0-5.3.25. The fix (commit 20afa3265a \"Encapsulate full path initialization\" by upstream author rstoyanchev@vmware.com) was included in the upstream release v6.0.11, which predates the target version 6.0.15. The fix normalizes security patterns by prepending \"/\" to non-empty patterns that don't start with \"/\", ensuring consistent pattern matching between Spring Security and Spring MVC, thereby preventing security bypass via pattern mismatch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:bd391269-ef5f-5fdd-bcb1-3fabb443a18c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 describes a DoS vulnerability in Spring Framework 6.0.0-6.0.13 where attackers can send HTTP requests with arbitrary/non-standard method strings, causing unbounded cardinality in Micrometer observation metrics and leading to resource exhaustion. The upstream fix (commit c18784678d by Brian Clozel) was included in Spring Framework 6.0.15. The target repository is at version 6.0.15...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:628be2dd-1dbd-592d-80e0-c1bdaeb5aae2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:2f13c962-5f21-5601-b742-445ea4485f58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:f69238df-6fc1-5cf2-af86-8e31f46908ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. Version 6.0.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:2c60fab1-8f8a-5005-812f-79e704736efb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:396d58c6-5d95-5492-b013-7eca63835a84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:3966498d-fa7c-595d-94b6-99d33261ab9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:89c056af-c03b-5507-b74e-12aba40cd02d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:948ca44f-b838-5151-a4f0-04f778c8f485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:970e5a11-6d05-5e67-a1d4-e19222e96c8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc, and is fixed in 6.0.15-tuxcare.5." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:08e0ccb4-d1c9-52e1-90b6-3e9bf8e82290", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:8507994f-323f-59a6-9601-36667d5213f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.15 contains the vulnerable version removal pattern (StringUtils.delete removes ALL instances of version strings instead of only the last), but PathResourceResolver provides an effective runtime defense that blocks path traversal attacks in the default configuration. The resolver validates that all resolved resources are under the configured allowed base location, preventing...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:97d3c1ee-5ea2-518a-b770-10124f6c1ab1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:7d79841b-7588-5e5b-b75b-5c3a5de6069f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:7538216c-b149-582e-9b21-735d50c563cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc, and is fixed in 6.0.15-tuxcare.5." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:aeb26781-2ae4-5202-a650-d7ebb4a59c3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:ea04203b-ca20-50a1-95ee-0bdcfe1c4e4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.15 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter class) was introduced in Spring Framework 6.2.0 (May 2024) and does not exist in version 6.0.15. Comprehensive searches confirmed no UrlHandlerFilter files, no similar trailing-slash redirect functionality, and no alternative implementations that could exhibit the same open redirect vulnerabili...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:15b4b95e-b60c-57a7-a982-b4e91442b8a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:04b496dc-bd73-5f81-92c4-6898e7efaf2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:704e1d44-3d87-5161-861c-46a47d4d1b1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.0.15 is not affected by CVE-2026-47890. The vulnerability exists in the Fragment API for SSE stream rendering, which was introduced in version 6.2.0-M7 (commits 6e55e78b22 and 8e2b27e5d8). Version 6.0.15 predates this feature entirely\u2014no Fragment class, no ViewResolutionResultHandler SSE fragment formatting, and no ResponseBodyEmitterReturnValueHandler.getFragmentContent() method exist in the target. The vulnerable code pattern (incomplete carriage return escaping in rendered view fragments) was introduced in v6.2.0-M7 with commit 8e2b27e5d8.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:d205232a-fae5-57a9-8989-10efe87b0348", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.15-tuxcare.4" } ] }