{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:510406d7-1844-57a1-81a7-ac88513099e6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7", "version": "6.1.4-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:2e093ec8-a349-5f68-a7e0-4f3aad8330c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.1.4. The upstream fix from commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 (Feb 2014) was already included in the upstream release when TuxCare onboarded version 6.1.4. The target code disables external entity processing by default via the processExternalEntities field (default false) ...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:650618fc-d51e-565e-85ef-7471841ef16e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is NOT present in Spring Framework 6.1.4-tuxcare.8. The upstream fix (commit 8e096aeef5 by Rossen Stoyanchev) that disables external entity resolution by default and installs no-op entity resolvers was already included in the Spring Framework 6.1.4 release that TuxCare onboarded. All XML processing classes have the defense: NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER return empty content instead of resolving external URIs in DTD declarations. External entity processing is disabled by default (processExternalEntities=false). The 6.1.4 version includes enhanced protection via StaxUtils.createDefensiveInputFactory() which centralizes the XXE defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:55eb5d3f-4db7-5259-9a72-744aaac41740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 6.1.4. The XSS vulnerability in FormTag.java was fixed by upstream Spring developer Rossen Stoyanchev in commit 741b4b229a, which was already included in the Spring Framework 6.1.4 release that TuxCare onboarded. The fix applies URI encoding (UriUtils.encodePath) to the request URI before rendering it in the form action attribute, preventing inje...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:d16d7049-b37f-571a-a915-a8cf2a9f963d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 6.1.4. The upstream fix (commit 9cef8e3001) shipped with the upstream release before TuxCare onboarded version 6.1.4. All defense mechanisms from the security patches are present and active: path normalization via processPath(), rejection of traversal sequences/URL schemes via isInvalidPath(), URL-encoded travers...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:99384817-dcdf-5344-94f5-2c46bda25fbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.1.4 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:50e532f9-8657-5483-aed4-81966863dc67", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Target Spring Framework 6.1.4 is not affected by CVE-2020-5397. The vulnerability affected versions 5.2.x prior to 5.2.3, allowing CSRF attacks through CORS preflight requests that bypassed authentication. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929) was authored by S\u00e9bastien Deleuze on 2020-01-10 and shipped in Spring Framework 6.1.4. All three defense mechanisms are veri...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6fafd329-8092-5e9e-a407-557dbb1e04e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. CVE-2020-5398 affects Spring Framework versions 5.0.x prior to 5.0.16, 5.1.x prior to 5.1.13, and 5.2.x prior to 5.2.3. The vulnerability allows a reflected file download (RFD) attack when user-supplied input is used in the Content-Disposition header filename parameter without escaping quote characters. The target version 6.1.4 is not affected because the fix (commit 41f40c6c) was already included in the upstream Spring Framework release before TuxCare onboarded version 6.1.4. The defense (escaping quotes and backslashes in filenames via the appendName method at lines 615-629 of ContentDisposition.java) is present and active in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:7aa751c3-1b98-5039-95cf-abb8c3d33d17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6d9624b1-2948-59e5-a2c8-bcd38fab9854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. Spring Framework 6.1.4 is NOT affected by CVE-2023-20860. The vulnerability involves pattern matching mismatch when using \"**\" patterns without a leading \"/\" in Spring Security configuration. The fix (pattern normalization that prepends \"/\" to patterns not starting with \"/\") was already present in the upstream Spring Framework 6.1.4 release. The target code implements the fix via PathPatternParser.initFullPathPattern() method (line 115: `return (StringUtils.hasLength(pattern) && !pattern.startsWith(\"/\") ? \"/\" + pattern : pattern);`), which provides the exact same protection as the upstream patch. This is an upstream fix authored by rstoyanchev@vmware.com, shipped in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:c1f15a45-a3f3-538e-af45-f29384078257", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework 6.0.0-6.0.13, causing DoS through unbounded KeyValue allocations when processing arbitrary HTTP method strings. The target version 6.1.4 already contains the upstream fix (commit c18784678d, Nov 2023) that validates HTTP methods against a known set before creating KeyValues. The fix was shipped in the upstream Spring Framework 6.1.4 release (Feb 2024) and...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:24f0864a-8d1e-5754-811c-bd93e223319b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f4de92ff-6109-5dbc-a40a-271f46b96d9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:dd587435-af2f-5f4e-a9df-0aa04bd925f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. Version 6.1.4 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b29a941c-ee73-5e75-a867-4a698a36640e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:34e37654-409a-5275-920c-b248206f7eea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:1acd910b-7310-5ce9-881a-2fe74644d501", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:e0390d54-c3ab-5873-9092-17af837ade82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:05e4a2c2-2a1c-5e1e-bee0-de54b0aa40e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:dfb28268-018a-59be-b249-cad862335344", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc, and is fixed in 6.1.4-tuxcare.9." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:54dc232c-0162-56ee-a0bc-39fb0dea9861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:04fd3cf5-85f7-5808-8ae8-5189af82716a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f7a5572f-a675-5089-b135-7aedd340d87f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:986f0cb0-9492-5d86-bcd3-d08adeb809e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:c352d641-28d2-58b4-b851-cb4e3ffd8367", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:e4f943fe-4b71-5ea5-9da0-f1d637b2478d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:0c08602a-0bbd-5268-a830-f38079387241", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter was introduced in Spring Framework 6.2.0 (May 2024) and does not exist in version 6.1.4. The open redirect vulnerability requires UrlHandlerFilter to process request URIs with leading double-slashes and use them in redirect Location headers without normalization. Since the entire UrlHandlerFilter...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:ecd88ea4-4567-5fbd-90b9-5c8d15c575dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:99bfb953-f145-5447-861a-ce35c74d49f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:fc99ab13-cd3a-50b8-99ac-172417de1b40", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc. Version 6.1.4 is not affected by CVE-2026-47890. The vulnerability concerns incomplete newline escaping in SSE (Server-Sent Events) view fragment rendering, but this feature was not introduced until version 6.2.0 (August 2024), which is 5.5 months after version 6.1.4 was released (February 2024). The Fragment class, FragmentViewResolutionResultHandler, and all related SSE fragment rendering code are completely absent from version 6.1.4. The CVE's stated affected range (6.2.0-6.2.19, 7.0.0-7.0.8) correctly excludes 6.1.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:02f64a1e-7822-5398-a75c-c4bf5caf2712", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.4-tuxcare.7" } ] }