{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c577a0d6-6313-5a52-a2cc-836b83d74035", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14", "version": "6.1.21-tuxcare.14", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.21", "type": "library", "group": "org.springframework", "version": "6.1.21" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:953ec75f-24a6-5602-85e0-f56843175bdc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework versions before 3.2.8 and 4.0.0 before 4.0.2. The target is Spring Framework 6.1.21-tuxcare.16, which already contains the upstream fix from commit edba32b309 (Feb 2014) that disables external entity resolution by default. The vulnerable pattern (unprotected XML parsing allowing XXE) is not present because the fix was shipped in the upstream Spring Framewo...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:c2819238-4641-5cce-98bd-9b7a045f6398", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is not present in Spring Framework 6.1.21. The upstream vendor fixed this vulnerability in May 2014 (commit 8e096aeef5) by adding NO_OP_ENTITY_RESOLVER to prevent external entity resolution when processExternalEntities is false (the default). This fix is present in the upstream v6.1.21 release that TuxCare onboarded. All four affected XML processing classes (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) contain the protection with processExternalEntities defaulting to false.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:aacf4ff9-b85d-5eaa-9655-801f2df1070a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 (XSS in Spring MVC FormTag) is not present in Spring Framework 6.1.21-tuxcare.16. The vulnerability allowed injection of arbitrary HTML/script via unencoded request URI in form action attributes when no explicit action was specified. The fix (UriUtils.encodePath() call at lines 648 in FormTag.java) was already present in the upstream release that TuxCare onboarded, not added by a ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:c8dd1fad-6820-52a4-b1ec-ce179624129e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Target version 6.1.21 is not affected by CVE-2014-3625. The directory traversal vulnerability was fixed by upstream Spring Framework in November 2014 (commit 9cef8e3001 by Rossen Stoyanchev, @pivotal.io) and released in versions 3.2.12, 4.0.8, and 4.1.2. All security defenses are present in the target code: path normalization, URL-decode with \"../\" detection, URL-like path rejection, and post-r...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:72356cc6-4761-53d7-bad6-64acd1e31b21", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.1.21 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:497ded47-42e7-5880-9da6-18856d28c38d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 is NOT present in Spring Framework 6.1.21-tuxcare.16. The vulnerability pattern (OPTIONS requests without Origin header bypassing CORS validation) has been fixed by upstream commit bc7d010485. This fix was already included in the upstream Spring Framework release that TuxCare onboarded, predating all TuxCare work on this version. The target contains all three fix components: (1) C...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:531c1c66-b7e9-5eba-b833-39a60217ef68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download attack via unescaped quotes in Content-Disposition header) is NOT present in spring-framework 6.1.21-tuxcare.16. The upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) was already included in the upstream release that TuxCare onboarded. The fix escapes double-quote and backslash characters in filenames via the appendName() method (lines 615-629 of ContentDisposition.java), preventing header injection attacks. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:08fa1563-362d-53c1-abd5-199e63a74164", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. Spring Framework 6.1.21 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:e5bb91b7-b931-58ec-9f9b-004ed6495f78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. The target Spring Framework version 6.1.21 is not affected by CVE-2023-20860. The vulnerability affected versions 6.0.0-6.0.6 and 5.3.0-5.3.25, but version 6.1.21 is newer and already includes the upstream fix. The fix normalizes path patterns by prepending \"/\" to patterns that don't start with \"/\" (like \"**\"), ensuring consistent interpretation between Spring Security and Spring MVC. This fix was authored by the upstream vendor (rstoyanchev@vmware.com) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:319e8e91-6b89-5a0e-9207-7bc4c3e060c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 is not present in Spring Framework 6.1.21-tuxcare.16. The vulnerability (unbounded cardinality DoS via arbitrary HTTP method strings in observation keys) was fixed by upstream commit c18784678d \"Reduce allocations in server conventions\" authored by bclozel@vmware.com. This fix shipped in the upstream Spring Framework 6.1.21 release before TuxCare onboarding (first TuxCare commit:...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:bbba1d10-5d3e-5aa4-afdd-6af03cfc765c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. CVE-2024-38816 path traversal vulnerability in Spring Framework RouterFunctions static resource serving. The target version 6.1.21 is NOT affected because the upstream vendor's security fix (commit d86bf8b) was already included in the upstream v6.1.21 release before TuxCare onboarded it. The fix adds comprehensive path validation including URL-decode-before-validate checks, path normalization, and traversal pattern detection to prevent attackers from accessing files outside configured resource directories.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:9958fff6-0833-5e62-99c6-65dcd5c229dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. The target Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-38819. The path traversal vulnerability fix was already present in the upstream Spring Framework 6.1.21 release that TuxCare onboarded. Three fix commits (3bfbe30a78, fb7890d739, e78179b96e) authored by upstream maintainer rossen.stoyanchev@broadcom.com implement early URL-decoding with path traversal validation in all four affected classes (PathResourceLookupFunction for WebMvc.fn and WebFlux.fn, ResourceHttpRequestHandler, ResourceWebHandler). The defense decodes paths (including double-encoded inputs), detects \"../\" sequences, normalizes them via StringUtils.cleanPath(), and rejects any resulting paths containing \"../\". Multi-layered validation via isInvalidEncodedInputPath() provides recursive checking against encoding bypasses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:c9e2c620-f9b0-5fa6-8c4c-8bd871692afe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. Version 6.1.21 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:9cf26852-3131-5764-a68a-76666218925c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:93d10967-5a74-51b4-8435-562bceeb6ada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:3b3564ce-1581-5abe-8dec-0e46acfc2a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:99a3dd1d-a14f-5f6d-bbe5-27f0a4f47a4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:fbc2627b-1283-5273-b41e-8e48e0262aa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:7491f499-494d-5029-8ba5-8137ea836548", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:f8de74a4-65dd-5a72-b413-9cc12ba1cd89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:c0b0ed45-5176-53f4-827f-5585757027ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:c19cd3a3-8a2b-53a1-9880-cffd8e31a748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:b946daa7-b109-5540-b312-cb6df745df08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:872d49a3-28ad-5dbc-876e-ddc995b4b856", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:ebd5e744-3e96-5025-b0d7-ff660858affb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:abaf2916-d7fb-5d89-af02-c1c7a0cbeed6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is not affected by CVE-2026-47883 because the vulnerable UrlHandlerFilter class does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0 (commit edb6bb717d, dated 2024-05-15) and was never backported to the 6.1.x branch. The target repository contains no code that constructs redirect Location headers from request URIs in the ma...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:29f8f331-9101-5de2-9346-17acf2525913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:531a5f64-5858-5fbc-90ca-564c97591a68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:8f22a445-3a2e-5144-919b-4f52f327ebee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc. Spring Framework 6.1.21 is not affected by CVE-2026-47890. The vulnerability requires the SSE view fragment rendering feature, which was introduced in version 6.2.0 (August 2024). Version 6.1.21 predates this feature entirely. While 6.1.21 has standard SSE support via SseEmitter, it already contains proper newline escaping logic identical to the patch fix. The vulnerable code path (getFragmentContent method in ResponseBodyEmitterReturnValueHandler and fragment formatting in ViewResolutionResultHandler) does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ], "bom-ref": "urn:uuid:60f810e4-94c4-576b-9e7d-15478678495f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.21-tuxcare.14 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.21-tuxcare.14" } ] }