{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:21831b7e-e5e4-59cd-9799-004ecd49e739", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3", "version": "6.2.14-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.14", "type": "library", "group": "org.springframework", "version": "6.2.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:58a7c2fb-3064-5f17-826e-810515a06c1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.14 is NOT affected by CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter). The XXE protection was already present in the upstream Spring Framework release when TuxCare onboarded version 6.2.14. The fix includes: (1) processExternalEntities field defaulting to false, (2) processSource() method that wraps StreamSource in SAXSource with XMLReader configur...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:f76d2815-5244-5e52-ae96-13ecbd9cf549", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE via unfiltered DTD external entity resolution) is not present in Spring Framework 6.2.14. The upstream vendor (Pivotal/VMware) fixed this vulnerability in 2014 (commit 8e096aeef5) by installing NO_OP entity resolvers and disabling external entity processing by default across all XML processing classes (Jaxb2Marshaller, AbstractMarshaller, Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter, Jaxb2CollectionHttpMessageConverter via StaxUtils). The fix was already included in the upstream release when TuxCare onboarded version 6.2.14 in commit 4bc6674c9c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:e5b7149b-7924-5317-9687-448f4608a7a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework 3.0.0-3.2.7 and 4.0.0-4.0.1, allowing XSS via unencoded request URIs in form action attributes. The target version 6.2.14 contains the upstream fix (commit 741b4b229a) that was released in v4.0.2.RELEASE (February 2014). The fix adds UriUtils.encodePath() at line 648 of FormTag.java to percent-encode special characters before rendering them in HTML, preven...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:35404677-f131-508b-b5dd-aef6903a8688", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.14 is not affected by CVE-2014-3625. All security protections from the vulnerability fix are present in the target version. The defenses were introduced by upstream Spring engineers and shipped in the 6.2.14 release that TuxCare onboarded. The vulnerable pattern (directory traversal in static resource handling) does not exist because comprehensive path validation, normaliza...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:e812d580-9953-5318-8e1f-59aca6d4488d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.14 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:607507c4-39f2-5468-8af9-df5898ee91b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target version (6.2.14) is significantly newer and already contains the upstream fix (commit bc7d010485 by sdeleuze@pivotal.io from January 2020). The fix was shipped in the upstream release that TuxCare onboarded in September 2026. All three components of the fix are present: (1) CorsUtils.isPreFlightRequest() requires Origin hea...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:1bcdceaf-a9b9-5233-a01d-3f643e9bd26f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 6.2.14 is not affected by CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename). The vulnerability affected versions 5.2.x < 5.2.3, 5.1.x < 5.1.13, and 5.0.x < 5.0.16. The upstream fix (commit 41f40c6c229d by rstoyanchev@pivotal.io, Dec 2019) that escapes double-quotes and backslashes in filenames was already present in the Spring Framework 6.2.14 release before TuxCare onboarding. The defense is implemented in the appendName() method at ContentDisposition.java:616-630, which prepends backslash to quotes and backslashes, preventing malicious filenames from breaking out of the quoted parameter value.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:dc566933-62b9-59e2-9f3f-a424cd93d1d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 6.2.14 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:27bffc68-be58-591f-90e3-acd50a8c377c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. Target version 6.2.14-tuxcare.3 is NOT AFFECTED. The vulnerability pattern (missing \"/\" normalization for patterns like \"**\" in Spring Security mvcRequestMatcher causing Spring Security vs MVC matching mismatch) is absent. The fix was already present in upstream Spring Framework v6.0.23 (commit 20afa3265a by rstoyanchev@vmware.com) and included in the v6.2.14 release that TuxCare onboarded. The target implements the same fix logic via PathPatternParser.initFullPathPattern(), which prepends \"/\" to patterns that don't start with \"/\", ensuring consistent pattern matching between Spring Security and Spring MVC.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:fc6fc6ab-5405-5790-86dc-bc9d1860729d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework 6.0.0-6.0.13, causing DoS through unbounded KeyValue allocations from arbitrary HTTP method strings. The target version (6.2.14) already contains the upstream fix (commit c18784678d by Brian Clozel) that validates HTTP methods against a known set before creating KeyValue observations. This fix was included in the upstream Spring Framework 6.2.14 release, ...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:0a28b494-38be-56ca-951d-c3893f8c235e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2024-38816 path traversal vulnerability is NOT present in Spring Framework 6.2.14. The upstream fix was already included in the Spring Framework 6.2.14 release before TuxCare onboarded it. The fix refactored path validation logic into ResourceHandlerUtils and added comprehensive URL-encoded path traversal defenses including double-decoding protection, normalization, and validation of both input paths and resolved resource paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:63c9223f-fe83-5dc1-b5ed-090cf1a6c566", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:2fbe849d-512b-51f9-a679-df4cdb5eadfc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. Version 6.2.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:bc67f18f-502b-579f-b80f-cb73c68e5745", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41242 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc. The upstream fix was released in 6.2.10, and version 6.2.14 is a later release of the same line. Advisories: GitHub GHSA-r936-gwx5-v52f (fixed in 6.2.10), CVE record (fixed in 6.2.10).", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:660836ac-eb35-505d-a3ca-ff01ffb3a788", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:a53f20c9-dcbb-5d14-bc1a-daedcbc2b9c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:d223b9fb-3adf-59a5-ba0c-b244cb4ee219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:8ff9731a-b9f6-5f86-bd3f-29abb61ecaad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:30b0d7bc-6dae-5a37-9953-ae549a06b425", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:e426d9d6-25fd-5b74-a50f-747746cc8d53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:616d19bf-fdae-5f14-9633-adc15a5c563f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:8916e841-1fa1-5643-b5d6-04008cbdb3d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:013e37b3-dfbc-54cb-ab4c-a753e98e0c00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:9d4692dd-b528-552f-b6b6-22674af9caa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:f02eb18e-ab33-555d-8ddf-5039c700710b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:4224da80-a331-5a08-94f2-fc00bca89001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:ff8606e8-8ac2-5a4f-a367-bacac24a8945", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:3fbd488a-40d7-5ce1-89af-4fce8a7bb827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b1bd1f5a-d53f-5ae7-9a87-7c20836b5d20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ], "bom-ref": "urn:uuid:6063f274-3ba8-5b29-8c2c-da987ad30cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.14-tuxcare.3" } ] }