{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2ec8c702-335e-57a5-99b5-c5264356c9d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4", "version": "6.2.3-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:46a835fc-c354-526c-b4d4-17a5e07c17fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.2.3. The XXE protection was introduced in the upstream Spring Framework release 3.2.8/4.0.2 in February 2014 (commit edba32b309) by Rossen Stoyanchev, long before TuxCare onboarded version 6.2.3. The current code at spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2R...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:11c61c20-a9da-5192-b54b-091332d5f495", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.2.3 is NOT affected by CVE-2014-0225 (XXE via unblocked DTD entity resolution). The upstream vendor (Pivotal/VMware) fixed this vulnerability in May 2014 via commit 8e096aeef5, which installed NO_OP entity resolvers to block external entity resolution by default. This fix was already present in the Spring Framework 6.2.3 release that TuxCare onboarded\u2014no backport was needed. All five affected XML processing classes (Jaxb2Marshaller, AbstractMarshaller, Jaxb2CollectionHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter) contain the defense code, and external entity processing is disabled by default (processExternalEntities=false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:adbeb8f8-0cce-51f0-b22e-07f31af8cce0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 6.2.3. The vulnerability was an XSS flaw where unencoded URIs were reflected in form action attributes. The upstream fix (commit 741b4b229a by rstoyanchev@gopivotal.com) shipped in Spring Framework 6.0.0+ and is present in this version. The target code correctly encodes the requestUri using UriUtils.encodePath() at line 648 of FormTag.java, preve...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:3d7dac16-79a7-5cbe-83ca-2071bf7b5354", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2014-3625. The directory traversal vulnerability in static resource handling was fixed upstream before this version was released. The target contains comprehensive security defenses in ResourceHandlerUtils.java (path normalization, traversal detection, location verification) and PathResourceResolver.java that prevent the attack described in the CVE....", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:fef89d16-cdec-5e71-87ce-2a1e399efb9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.3 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:cfe5647f-6883-5dda-8f04-9d5d5fcf989d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3, targeting CSRF attacks via CORS preflight requests. The target repository is Spring Framework 6.2.3-tuxcare.4. All three components of the upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) are present: (1) CorsUtils.isPreFlightRequest() requires Origin header in addition to Access-Control-Request-Meth...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c010ddc3-246e-51aa-b85c-009ef21873b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. CVE-2020-5398 is not present in Spring Framework 6.2.3. The vulnerability concerns reflected file download (RFD) attacks via unescaped quotes in Content-Disposition header filenames. The upstream fix (commit 41f40c6c22 \"Escape quotes in filename\" by Rossen Stoyanchev) is present at spring-web/src/main/java/org/springframework/http/ContentDisposition.java:616-630. The appendName() method escapes quote and backslash characters before including filenames in headers, preventing header injection. This fix was shipped in the upstream Spring Framework 6.2.3 release before TuxCare onboarding (confirmed via merge-base analysis showing fix commit is ancestor of first TuxCare commit cbda719a7f).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:3172e2df-d7dd-5eb6-b5cb-628da88dfa8f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:a9c0198c-015b-53d6-a644-4c5246888065", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. CVE-2023-20860 affects Spring Framework 6.0.0-6.0.6 and 5.3.0-5.3.25 when using \"**\" pattern with mvcRequestMatcher, causing a pattern matching mismatch between Spring Security and Spring MVC that could lead to security bypass. The target (Spring Framework 6.2.3-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in the 6.2.3 release. The fix normalizes URL patterns by prepending \"/\" when missing, implemented in PathPatternParser.initFullPathPattern() (commit 20afa3265a, authored by rstoyanchev@vmware.com on 2023-07-11). This fix was IN_UPSTREAM_RELEASE before TuxCare work began (first TuxCare commit: cbda719a7f).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2c5bb5f6-3476-525e-af35-95f9098f575c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.3-tuxcare.4 is not affected by CVE-2023-34053. The vulnerability (unbounded memory allocation via arbitrary HTTP method strings in observation metadata) is not present. The fix was applied in upstream commit c18784678d by Brian Clozel (Spring maintainer) and shipped in the upstream 6.2.3 release before TuxCare onboarded it. Both DefaultServerRequestObservationConvention imp...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:589d79c9-a82a-573b-8e79-2741782d2d34", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. CVE-2024-38816 path traversal vulnerability is NOT present in Spring Framework 6.2.3-tuxcare.4. The upstream Spring Framework team fixed this vulnerability in commit d86bf8b205 (Sep 2, 2024) as part of the 6.2.0/6.2.1 release cycle. The fix was subsequently refactored into ResourceHandlerUtils utility class (commit c6fa180602, Sep 20, 2024) and shipped in the official 6.2.3 release (Feb 13, 2025) that TuxCare later onboarded. The target code includes comprehensive URL-encoded path traversal defenses via ResourceHandlerUtils.isInvalidEncodedPath() and isInvalidEncodedResourcePath() methods, which validate both input paths and resolved resource paths for traversal sequences like \"../\" and \"..\\\\\". This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:85aaf52d-ff0d-5760-864e-b5412273caab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. Prechecker: The upstream fix is already in this version's source history (commits 3bfbe30a, fb7890d7). Version 6.2.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-g5vr-rgqm-vf78 (affected up to 6.1.14), CVE record (affected up to 6.1.13), Snyk (affected up to 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:78567d41-94b4-5764-a4aa-0f8765806df3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc. Version 6.2.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e836335a-f1b8-5f9a-8d73-1d36593d48d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:61c74947-10e1-5796-9e17-b357c72d4000", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:4c86772a-597a-5429-adcd-165976e91682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:87e88532-b053-55b1-9a96-6a1d5b148aa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:bf6d592f-dc85-59f9-896d-74a39f67a91a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:4f65baff-8b24-5950-8bc5-20bd8f730f19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:83348910-c043-5af2-a916-1b79b41b202a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:548fd3de-8d7a-5367-a051-fb722f723496", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:0436115c-f269-5024-882b-656714edde18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:110fc38b-9347-5082-8f5b-eacb24e88ca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:3a7cc04d-108c-556f-8614-d2c2e88d7b0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:a42743c2-e7b1-5212-9516-dd9c8d6df6e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:0972f2d4-fd25-59c5-a6f3-12acd642d123", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:ef2835e2-69bc-5d13-8459-532f0b5d9429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:6818703a-a2ce-5411-9faf-8d00e91ccd54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:6b8c207d-24e6-5473-ba50-6899880fd731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:b04bae2f-507c-5a2a-a300-670ea3977163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.4" } ] }