{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:953a500f-c430-5c64-9be2-c4b5da3e9e70", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3", "version": "5.1.18.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.18.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ae75974d-c2ba-520a-ab3d-f1eb2d4a306c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 describes an XXE vulnerability in SourceHttpMessageConverter where external entity resolution was enabled by default, allowing attackers to read arbitrary files or cause DoS. The upstream Spring Framework fix from 2013-11-05 (commit 2ae6a6a341) disabled external entity processing by default and was already present in version 5.1.18.RELEASE when TuxCare onboarded it in 2026-09-08. ...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:89d7f01a-4f27-5ec8-866a-42009c43c3d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE already contains the fix for CVE-2013-6430. The vulnerable pattern is not present because the upstream vendor (VMware) applied the fix in commit f5c9fe69a444607af667911bd4c5074b5b073e7b by Rossen Stoyanchev (rstoyanchev@vmware.com), which was included in the upstream release that TuxCare onboarded. The JavaScriptUtils.javaScriptEscape method properly e...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e11a2917-db27-5b06-a945-48a133e43bce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 5.1.18.RELEASE. The fix for this vulnerability was included in the upstream Spring Framework release that TuxCare onboarded. All XML parsing classes (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter) have DTD processing disabled by default (supportDtd=false) and set the disallow-doctype-decl pa...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3fc5d538-321d-5858-9ad7-7613a13db161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7be221b5-58d8-5b9b-b821-2dc76638aeda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE is NOT affected by CVE-2018-11039. The vulnerability allowed arbitrary HTTP method changes (including TRACE) via the HiddenHttpMethodFilter, enabling XST attacks when combined with XSS. The upstream Spring Framework team fixed this vulnerability in May 2018 by adding an ALLOWED_METHODS whitelist that restricts method changes to only PUT, DELETE, and PA...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:80ff13c5-d8a2-58f8-924d-d0283ca3132a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:5b8bed52-9624-51df-bbe7-7b69d4bc1300", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:fb4157aa-c82d-59d2-aa8e-30c0dac92bf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:31267774-b8a3-5f26-8821-9b470b95e367", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:919f7f51-31e4-558c-b60e-f56576d6a4ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:428caa26-5cbb-5bc0-9bd1-dd49be0b96d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Version 5.1.18.RELEASE is not affected by CVE-2024-38820. This CVE concerns locale-dependent behavior in toLowerCase() calls that were introduced by the CVE-2022-22968 fix. The target version never received the CVE-2022-22968 fix and therefore does not contain any toLowerCase() operations in its DataBinder disallowed field matching logic. The vulnerable code pattern is completely absent from th...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e37d99bb-140e-52fc-bc8d-6a400192022d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT affected by CVE-2025-41234. The vulnerability exists only in version 6.x where a new MIME-style encoding architecture was introduced. In 6.x, when using non-ASCII charsets, the code outputs BOTH filename= (with Quoted-Printable encoding) AND filename*= parameters. The vulnerable Quoted-Printable encoding uses a PRINTABLE BitSet that, before the patch, did ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:cc879998-da82-532a-bf8e-75ca1863bab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:778885ec-5c85-5a90-8fef-9599ff4ad615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:eae7bd87-43f6-558b-bcff-102c76bf072d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47885. The vulnerable component `PartEventHttpMessageReader` does not exist in this version. The `PartEvent` API and `PartEventHttpMessageReader` class were introduced in Spring Framework 6.0.0-M4 (February 2022), well after the 5.1.18.RELEASE version was released. This version uses `SynchronossPartHttpMessageReader` with a different a...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:229dab10-3ffb-5272-af6e-bacb266f2bb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE does not contain the vulnerable JettyCoreServerHttpResponse class, which was introduced in Spring Framework 6.2+ (January 2024) for Jetty 12 Core support. The CVE specifically affects \"a WebFlux application running on the Jetty 12 Core reactive adapter.\" The target uses Jetty 9.4.31 with a servlet-based adapter (JettyServerHttpResponse extending Servle...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:60bf1b93-1c73-506a-a74e-8926f9412d30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a48056f2-b7c4-5724-afe9-d9f149d13711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.1.18.RELEASE-tuxcare.3 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.1.18.RELEASE-tuxcare.3" } ] }