{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:79bee75d-2d19-55a5-966f-ec645718353c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6", "version": "6.2.1-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.1", "type": "library", "group": "org.springframework", "version": "6.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:9e1c2fa7-52cc-5140-b318-00dd44c02023", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is not present in Spring Framework 6.2.1. The fix was already included in the upstream release that TuxCare onboarded. The vulnerable pattern (external entity processing enabled by default) was removed by upstream commit edba32b3093703d5e9ed42b5b8ec23ecc1998398, which added processExternalEntities flag (default false) and...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:33c973b2-349f-5232-b08f-17e7b1d77715", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability in XML DTD processing) does NOT affect Spring Framework 6.2.1-tuxcare.6. The upstream fix was applied in May 2014 (commit 8e096aeef5 by Rossen Stoyanchev) and was already included in the upstream 6.2.1 release that TuxCare onboarded. All affected XML processing classes now install a NO_OP_ENTITY_RESOLVER that returns empty InputSource for entity resolution requests when processExternalEntities is false (the default), preventing XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:b61a7189-4f28-573a-89ea-72758b7913c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability was an XSS issue in FormTag.java that allowed injection of malicious script via unencoded request URIs in form action attributes. The fix (adding UriUtils.encodePath() to encode special characters) was applied by upstream Spring Framework in February 2014 (commit 741b4b229a by rstoyanchev@gopivotal.com) and has ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:5f773579-facb-52b5-b3ee-b0905eaa78a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in static resource handling) is NOT present in Spring Framework 6.2.1. The vulnerability affected versions 3.0.4-3.2.11, 4.0.0-4.0.7, and 4.1.0-4.1.1. The fix (path normalization, traversal checks, URL validation, and location verification) was introduced upstream in 2014 and has been present in all subsequent releases. Spring Framework 6.2.1, released in 2024...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:f9266cac-2a2a-5e08-9093-5f005d72c392", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.1 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0b0e9de6-72fb-5144-9892-27ab96e2efd7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 is not present in Spring Framework 6.2.1. The vulnerability allowed CSRF attacks via malformed CORS preflight requests (OPTIONS with Access-Control-Request-Method but without Origin header) that bypassed validation. The upstream fix was committed by S\u00e9bastien Deleuze on 2020-01-13 (commit bc7d010485) and shipped in the Spring Framework 6.2.1 release that TuxCare onboarded. All thr...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:e91f366c-600d-5c02-be08-4fba0916d469", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. CVE-2020-5398 is not present in Spring Framework 6.2.1. The vulnerability affects versions 5.2.x prior to 5.2.3, 5.1.x prior to 5.1.13, and 5.0.x prior to 5.0.16. The upstream fix (commit 41f40c6c22) was already included in the Spring Framework 6.2.1 release that TuxCare onboarded. The appendName method properly escapes quote characters and backslashes in filenames before writing them to Content-Disposition headers, preventing header injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:8e3b0e77-6097-586d-8463-9f5791656f33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. Spring Framework 6.2.1 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:8a3360b1-3e36-5855-b4d1-e529db19151f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. CVE-2023-20860 is not present in Spring Framework 6.2.1-tuxcare.6. The vulnerability involved pattern matching mismatch between Spring Security and Spring MVC when using \"**\" patterns without a leading \"/\". The fix, which normalizes patterns by prepending \"/\" when missing, was already shipped in the upstream 6.2.1 release and is present in the target code at PathPatternParser.initFullPathPattern() (line 115) and invoked from LookupPathMatchableHandlerMapping.match() (line 592).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:7976c508-85a8-5677-8de5-7e163644331e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2023-34053. The vulnerability (unbounded KeyValue allocations from arbitrary HTTP method names causing DoS) was fixed in upstream commit c18784678d (\"Reduce allocations in server conventions\") by Brian Clozel, which shipped in the upstream 6.2.1 release. Both DefaultServerRequestObservationConvention classes (spring-web and spring-web reactive) vali...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:42676458-e28a-5f07-9129-e3e63d4ff6e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. The target repository (Spring Framework 6.2.1) is not affected by CVE-2024-38816. The path traversal vulnerability was fixed in upstream commits d86bf8b205 and c6fa180602, which were already part of the upstream 6.2.1 release before TuxCare onboarded it. The fix prevents path traversal attacks by decoding URL-encoded paths and validating them for traversal sequences (\"../\", \"..\\\") before resource lookup. Both WebMvc and WebFlux functional router resource handling are protected via the ResourceHandlerUtils utility class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:be9bd43b-69e2-5f32-a9ad-55cbc718a13f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:4d25724c-7156-5a38-9ce5-2c0144bb578a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2024-38828 affects ContentCachingRequestWrapper when processing requests with large Content-Length headers, causing unbounded memory allocation. The target repository version 6.2.1-tuxcare.6 is NOT AFFECTED because the upstream fix (commit 0ca393c0dc by Brian Clozel) was already present in Spring Framework 6.2.1 when TuxCare onboarded it. The vulnerable pattern (allocating FastByteArrayOutp...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:49088b94-5e28-52ef-b72b-59100dce40d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:612c5a5f-d5fe-5ff6-a0d6-9218d97c0ca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:a392cad6-5655-5d54-92a5-84da8c8508ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:00b58145-667a-54d1-a2e9-cb7cb13dfde0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:571c04fa-16b9-5915-83a2-47f61e09c51b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:be683e73-9fb3-538b-9414-18098eb1227f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:83bf7f4c-452e-59c2-8b60-3f29bfdbd114", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:cb7e1aa5-dc78-5933-b663-86d86fb803f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:d42e0358-3e16-539c-9157-e2aee6b4d955", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:9e3a70a0-e05d-5daa-917a-52bf75a43fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:a5de43f4-53f4-55ba-b3f9-5ab114ef36c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:bc62f92a-0f75-56bb-aa21-cff677cc3101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:273cdb20-2ae9-57c1-bcc6-82cd13a8d8de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:e1b58a3b-1c65-5fed-acb5-2299a8f6bcb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:622b1351-25da-5d61-b800-9b2a02cfe10d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:a091e36e-5534-5d7d-a4ee-67093e6a3046", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:26158330-edc9-5e6e-9625-6b19b71a0853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.1-tuxcare.6" } ] }