{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:17fdb6cb-9b97-5b00-8daa-49ed5e737eba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:37f2af9a-e385-53f7-b508-3b5b949ad6bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.16 is NOT AFFECTED by CVE-2014-0054. The XXE vulnerability in Jaxb2RootElementHttpMessageConverter was fixed in upstream commit edba32b309 (Feb 2014), which shipped in the upstream release before TuxCare's first commit (73712e8616). The fix adds processExternalEntities property (default: false) and processSource() method that wraps XML input with an XMLReader configured to ...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:e819b769-c598-5563-9499-cd1c9eedf300", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is not present in Spring Framework 6.1.16. The upstream fix (commit 8e096aeef5 by Rossen Stoyanchev, May 2014) was already shipped in the Spring Framework release that TuxCare onboarded. All XML processing classes (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) install NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER that return empty content instead of resolving external entities. External entity processing is disabled by default (processExternalEntities=false), blocking XXE attacks at parse time.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4eb9a628-b1a2-5330-a696-7a0ccd1d05c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 6.1.16-tuxcare.7) is NOT affected by CVE-2014-1904. The XSS vulnerability in FormTag.java's default action attribute has already been fixed by the upstream vendor. The fix (commit 741b4b229a by Rossen Stoyanchev) adds URI encoding via UriUtils.encodePath() before writing the request URI to the HTML form action attribute, preventing injection of arbitrary ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8e0b18c8-1370-5913-ac12-8de2f8b76b86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 affects Spring Framework versions 3.0.4 through 3.2.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.2. The target version 6.1.16-tuxcare.7 is NOT vulnerable because the upstream security fix (commit 9cef8e3001) was introduced in Spring Framework v4.1.2.RELEASE (November 2014) by upstream author Rossen Stoyanchev and shipped in all subsequent releases including 6.1.16. All five defens...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:872d3381-ba02-5d0e-aace-9c3ab728f1d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.1.16 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:057b8f6f-436a-5eec-8edf-c30a440751f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2020-5397. The vulnerability, which allowed CSRF attacks through improperly validated CORS preflight requests, was fixed in upstream Spring Framework 5.2.3 (January 2020). The fix is present in version 6.1.16 through upstream commit bc7d010485 by S\u00e9bastien Deleuze, which added Origin header validation to isPreFlightRequest() and ensures all preflig...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:a6c059dd-aac3-542e-8b25-28fbb0e2344d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. Spring Framework 6.1.16 is NOT affected by CVE-2020-5398. The vulnerability involves a reflected file download (RFD) attack through unescaped quote characters in the Content-Disposition header's filename parameter. The fix (escaping quote and backslash characters) was introduced in the upstream Spring Framework by commit 41f40c6c22 (Dec 2019) and is present in the target at spring-web/src/main/java/org/springframework/http/ContentDisposition.java. The appendName() method (lines 615-629) properly escapes both quote and backslash characters before inserting filenames into Content-Disposition headers, preventing header injection attacks. This fix was already included in the upstream Spring Framework 6.1.16 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4456cde8-b3d8-517e-b0a2-bd7b6a5baa73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:36f65d88-bccd-5d5c-90b7-43a7f7d01c13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. CVE-2023-20860 is not present in Spring Framework 6.1.16. The vulnerability involved a pattern matching mismatch when using \"**\" without a leading \"/\" in Spring Security's mvcRequestMatcher. The upstream fix (commit 20afa3265a by rstoyanchev@vmware.com, July 11, 2023) added the initFullPathPattern() method to PathPatternParser which prepends \"/\" to non-empty patterns lacking it. This fix was already included in the upstream Spring Framework 6.1.16 release before TuxCare onboarded the version, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d3f7b1f1-927f-5482-a824-0c4621f5aa08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 is NOT present in Spring Framework 6.1.16-tuxcare.7. The vulnerability involves denial-of-service through unbounded KeyValues allocations when processing HTTP requests with arbitrary, non-standard method names. The upstream fix (commit c18784678df489d06a70e54fcddb5e3821d4b00c by Brian Clozel from VMware) was included in Spring Framework 6.0.14 and was already present in the upstr...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:430bb071-79bb-514c-adba-e4bf1602a930", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.1.13, and version 6.1.16 is a later release of the same line. Advisories: GitHub GHSA-cx7f-g6mp-7hqm (fixed in 6.1.13), CVE record (fixed in 6.1.13), Snyk (fixed in 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8767d694-414c-562c-b671-abaca9a0fb30", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. CVE-2024-38819 (path traversal via URL-encoded sequences in static resource paths) does NOT affect Spring Framework 6.1.16-tuxcare.7. The upstream fix commits (3bfbe30a \"Normalize static resource path early\" and fb7890d7 \"Update processPath for double encoding\", both authored by rossen.stoyanchev@broadcom.com on Oct 14, 2024) were already present in the upstream Spring Framework 6.1.16 release that TuxCare onboarded. All 4 affected files (PathResourceLookupFunction in webflux/webmvc, ResourceWebHandler, ResourceHttpRequestHandler) contain the normalizePath() defense that decodes paths (up to twice for double-encoding) and applies StringUtils.cleanPath() when \"../\" is detected, preventing encoded traversal attacks. The vulnerable pattern (checking for \"..\" on raw encoded paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8b095a63-0bdb-50cf-9c51-a3888cd15aeb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. Version 6.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3968a7c7-aefb-5362-bcda-2461bb76b838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:f0936b72-0125-52f6-8284-977ee9f316f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:59ff9a0b-357e-5548-875b-35fe94f7caf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:145a5813-7dc5-55d8-875f-840a80a4164e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:838db90e-7f5e-5783-b31a-2463b5bd7bf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:e14a8149-647f-57e3-8aa1-b7a7114936d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:f84e79c5-4a3a-5048-b297-26604ebe0117", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:255bc346-6cf4-5a2e-83aa-3e8b41e90069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc, and is fixed in 6.1.16-tuxcare.7." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d2c95c35-4a0d-5890-b715-0bbc298e6e04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b10c92f5-1433-5113-a702-126b00bcb5df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:a51ba860-282d-54fd-afa4-2b46752fce0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:6d20f0d4-b0d3-5c4e-96fd-e0a6acc8fa9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:54645efd-1c69-5cef-9060-e9927992a71f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced in Spring Framework 6.2.0 (May 2024). Version 6.1.16 predates the introduction of UrlHandlerFilter entirely and contains no equivalent trailing-slash redirect functionality that could be vulnerable to the double-slash open redirect issue.", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ea1f28be-6b68-5a9e-a9c4-98b01b1284a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:336e081b-b2fa-5342-bc8f-924068c62e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:997b4ab2-8d2f-5cec-8b43-d16ae108396a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc. Version 6.1.16 is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r, \\r\\n) in SSE (Server-Sent Events) fragment rendering, which causes stream corruption. This SSE fragment rendering feature was introduced in Spring Framework 6.2.0 (commit 6e55e78b22). Version 6.1.16 predates this feature entirely\u2014the Fragment class, SSE fragment formatting code, and related infrastructure are completely absent from the codebase. The CVE's stated affected range (6.2.0-6.2.19, 7.0.0-7.0.8) correctly excludes 6.1.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:cc50a451-46a7-5aab-bc35-f6babae7ed1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.16-tuxcare.6" } ] }