{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:08ae9f43-566e-52a6-9488-53a33f1083db", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4", "version": "6.2.13-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.13", "type": "library", "group": "org.springframework", "version": "6.2.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:02b087eb-e311-506e-9f10-ff6e290d4031", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2014-0054. The XXE vulnerability in Jaxb2RootElementHttpMessageConverter was fixed in the upstream Spring Framework release (commit edba32b309 by rstoyanchev@gopivotal.com) that TuxCare onboarded. The current code disables external entity processing by default via SAX feature flags and NO_OP_ENTITY_RESOLVER, preventing XXE attacks. This is an upstr...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:18b89a2f-e621-5cf1-bee3-7948af87868f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.2.13 is not affected by CVE-2014-0225. The XXE vulnerability fix was introduced in upstream commit 8e096aeef5 (May 2014) by Rossen Stoyanchev and was already present in the upstream release before TuxCare onboarded version 6.2.13. All XML converters (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2Marshaller) implement NO_OP_ENTITY_RESOLVER defenses that return empty content instead of resolving external entity URIs, with external entity processing disabled by default (processExternalEntities=false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:67e3b2f1-02a0-5514-be12-5646f7d1330c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 6.2.13. The vulnerability was an XSS flaw where unencoded request URIs were placed into form action attributes. The upstream fix (commit 741b4b229a by rstoyanchev@gopivotal.com) adds URI encoding via UriUtils.encodePath() and was already included in the upstream Spring Framework 6.2.13 release that TuxCare onboarded. The protection is present at ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:9f3717dc-ef0b-56d2-9a1c-5ec88d7d5ebd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 affects Spring Framework versions 3.0.4-3.2.11, 4.0.x-4.0.7, and 4.1.x-4.1.1. The target version 6.2.13 is significantly newer and contains the complete fix that was introduced by upstream Spring Framework in November 2014 (commit 9cef8e3001, issue SPR-12354). The vulnerable code pattern - lack of path normalization, directory traversal validation, URL scheme rejection, and resour...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d41a7b06-d899-56b3-ae0e-055eef16b4c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.13 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:7dd36be9-d8ea-5679-b8d7-90eb9502a6e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.13 is NOT affected by CVE-2020-5397. The vulnerability (CSRF attacks via malformed CORS preflight requests missing Origin header) was fixed in upstream Spring Framework 5.2.3 (January 2020) by commit bc7d010485. All three fix components are present in the target: (1) CorsUtils.isPreFlightRequest() requires Origin header, (2) AbstractHandlerMapping routes all valid preflight...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:6c1df920-3d1c-5a2e-bd9c-d71715d19bbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. The target repository (spring-framework 6.2.13-tuxcare.4) is not affected by CVE-2020-5398. The vulnerability was fixed in upstream commit 956ffe68 (Dec 2019) by Rossen Stoyanchev (Pivotal/VMware), which added quote escaping to prevent RFD attacks via Content-Disposition filename parameters. This fix was included in the upstream 6.2.13 release that TuxCare onboarded. The current code uses the `appendName()` method (lines 616-630 in ContentDisposition.java), which escapes quotes and backslashes in filenames, preventing header injection and RFD attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:5200794d-8a9b-5d83-b576-d8a7b3548999", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.2.13 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:c350270d-8d50-548f-937f-b60247352b7e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. CVE-2023-20860 is NOT present in Spring Framework 6.2.13. The vulnerability concerned a pattern matching mismatch between Spring Security and Spring MVC when using patterns like \"**\" without a leading slash. The fix (normalizing patterns by prepending \"/\" to non-slash-prefixed patterns) was already included in the upstream Spring Framework 6.2.13 release via commit 20afa3265a (\"Encapsulate full path initialization\") by rstoyanchev@vmware.com on 2023-07-11. This commit introduced the initFullPathPattern() method in PathPatternParser that performs the required normalization, and it was already present when TuxCare onboarded version 6.2.13 (first TuxCare commit: 819b4ff3b7 \"Onboard version 6.2.13\"). The target version ships with the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a3f83eda-9d3c-5082-b34a-66dafdbb5283", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.2.13-tuxcare.4 is not affected by CVE-2023-34053. The vulnerability involved unbounded memory allocation from creating high-cardinality KeyValue objects when processing HTTP requests with arbitrary method strings. The fix (commit c18784678df489d06a70e54fcddb5e3821d4b00c) was already present in the upstream Spring Framework 6.2.13 release that TuxCare onboarded. Bot...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:3675db43-94f2-59ae-b63b-83a3ff6556ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.2.13 already contains the complete fix for CVE-2024-38816 (path traversal in static resource serving). The fix was authored by upstream Spring Framework developers (rossen.stoyanchev@broadcom.com) and shipped in the upstream 6.2.13 release before TuxCare onboarded it. The vulnerable code pattern (missing URL-decode validation for path traversal) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:11b9c1df-9ddc-5798-a0dc-93444f54f64f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:20a56e12-e503-5ca0-86d2-8f93c4b096af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2024-38828: Spring Framework 6.2.13 is not affected. The vulnerability (unbounded memory allocation in ContentCachingRequestWrapper based on attacker-controlled Content-Length header) was fixed by upstream vendor commit 0ca393c0dc, which was already included in the upstream 6.2.13 release that TuxCare onboarded. The fix limits buffer allocation to Math.min(contentLength, contentCacheLimit) ...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:91e87ce8-0fb9-515f-9913-2d77a2edd4ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41242 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc. The upstream fix was released in 6.2.10, and version 6.2.13 is a later release of the same line. Advisories: GitHub GHSA-r936-gwx5-v52f (fixed in 6.2.10), CVE record (fixed in 6.2.10).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:55f3da12-28c4-5f21-aa05-b91a4d5a0f6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a63c9226-c96e-5d27-b00b-0c16d67bd44f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:bb609cbc-7b25-5fc5-b8b3-60715746d09e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8a21533f-19b8-5a52-89cb-9bcc10282ef5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:c3e6264f-540f-51f8-8481-f3030552320d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:5aa19dff-b724-564d-b43a-cbb04048073a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:ff33abd4-f6af-5e38-98a5-14c2114e17d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:3ab031bf-bb87-5dc8-9d39-24947576dbc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a20a7e4b-f9b9-575f-b32d-f353f05af69b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:9bb329b0-c7d2-567e-b6f2-10254bd5899b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:bba91ce1-263c-5a77-bd5f-b8678e13d92b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:451da1cc-e442-5a5d-9227-1ab1dbd04f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e7ad2f58-ec6d-530e-9e28-bf42d2822794", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:db4bccc8-3f16-51ca-b425-861ba509c943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:65d287dc-be33-567b-9ab0-157b3a600e09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ], "bom-ref": "urn:uuid:135b3d2b-08fa-5cf1-b9e5-9fc3ea4e2fe3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.13-tuxcare.4" } ] }