{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8b23da0c-409d-543b-bbc4-6ce9b094cdff", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1", "version": "2.5.4-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@2.5.4", "type": "library", "group": "org.springframework", "version": "2.5.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:9d7820bc-64cc-5fca-a275-370885f400dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target is Spring Framework 2.5.4, which predates the HttpMessageConverter infrastructure (introduced in 3.0). SourceHttpMessageConverter does not exist and no framework code parses an XML request body into a Source/DOM/SAX object, so the XXE chain from request XML to external entity resolution is absent (Type A1).", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:8be69a9d-bf3f-5350-bd50-775632bec161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-6430 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:4cee40e6-2671-5a21-878e-3dd75e61102e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target is Spring Framework 2.5.4, which predates the components CVE-2015-3192 concerns. It has no StAX support, no XML HttpMessageConverters, and no oxm/JAXB unmarshalling. Its only XML parsing is trusted bean-definition loading and XSLT views fed developer-supplied sources. No path carries attacker-controlled inline-DTD XML to an expansion that exhausts memory.", "justification": "code_not_reachable" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f926a1c1-c56f-5369-9a92-83e20e380188", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 2.5.4-tuxcare.1 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c952f9b9-b1f5-5157-8679-dbaf3082819a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 2.5.4 has no HiddenHttpMethodFilter and no other mechanism that lets a request parameter override the HTTP method. CVE-2018-11039 concerns that filter, which was added in Spring 3.0, so the vulnerable component is absent from this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:00cfcb2a-e564-50a3-aaa1-17e99cd5daba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. Target is Spring Framework 2.5.4 (TuxCare ELS). CVE-2021-22118 affects the WebFlux reactive multipart reader (Synchronoss-based) in 5.2.x/5.3.x. WebFlux, reactive streams and the Synchronoss multipart reader do not exist in the 2.5.4 tree. The only multipart handling is the Servlet/Portlet Commons FileUpload resolvers, which are a different component and are outside this CVE's scope.", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:099c23ad-f5d3-5026-8a4d-fff0a7fd19a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f8597b16-0fd3-51d7-a761-d6c04f899712", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:8cf1a244-203c-5486-adaa-dbe7cd121a8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:cf7b21e1-4827-560c-9d0e-8bb9538fadd8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target is Spring Framework 2.5.4 (spring-web). It has no ETag support and never reads If-Match or If-None-Match headers. The regex-based ETag parser that CVE-2024-38809 fixed does not exist here, so the flaw has no code to live in.", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:2fba1d00-ceea-5408-b060-5816992f4e15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 2.5.4 has no case-folding in DataBinder at all, so the locale-dependent String.toLowerCase flaw from CVE-2024-38820 cannot occur. Disallowed-field patterns and bean property lookup are both exact-case, so a differently-cased field name cannot reach a protected property, and the case-folding mismatch the fix addresses has no path here.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:99cf18ea-0836-5436-ac7b-212938942a65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target is Spring Framework 2.5.4. It has no org.springframework.http.ContentDisposition class and no ContentDisposition.Builder#filename(String, Charset), which only appeared in Spring 5.0. The only Content-Disposition usage is in the JasperReports views, where the header value is a configured constant or mapping, not a filename built from request input with a charset. The flawed code path is a...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:5344cd9f-8bf3-5fb1-b4f6-29984d8cc752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:fedfad6d-727b-57e0-9b13-e8c1a048c001", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target is Spring Framework 2.5.4 (TuxCare ELS branch). The CVE concerns incorrect host parsing in UriComponentsBuilder, which was added in Spring 3.1. Neither UriComponentsBuilder nor any UriComponents or UriUtils code exists in this tree, so there is no code that parses an external URL string into host components for validation. Not affected (Type A1: input-processing component absent).", "justification": "code_not_present" } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:16e71aec-e5bc-59fd-af1a-4ab717c2e52f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. Prechecker: The functions the fix changes do not exist in this version. Version 2.5.4 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:07a310c4-7881-5ddc-a0cf-c2fcfcf315f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47889 affects version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:dd41ac4a-85c7-52d3-87b6-4497ccff77f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:46dc94b7-bec8-5281-8bbb-01b9046fe59d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59314 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target is Spring Framework 2.5.4 (same product lineage as the CVE). It has none of the affected components: no ContentDisposition builder, no HttpHeaders/http package, no outbound multipart HTTP writer. The only Content-Disposition code is the JasperReports views, which use static configuration values, not request input. Not affected (Type A1).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@2.5.4-tuxcare.1" } ] }