{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d3a940b-1768-5890-bade-016a19ee898c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10", "version": "5.3.24-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.24", "type": "library", "group": "org.springframework", "version": "5.3.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:27558c52-9325-5d52-a6bc-bf77c00bd864", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 affects Spring Framework before version 3.2.5 and 4.0.0.M1 through 4.0.0.RC1. The target version 5.3.24-tuxcare.10 is significantly newer (released Nov 2022) and contains the complete fix for XXE vulnerability. The SourceHttpMessageConverter class has processExternalEntities defaulting to false, with all XML parsers (DOM, SAX, StAX) configured to disable external entity resolution...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:e6720e98-2363-5e86-8b25-e5fd3f9706be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.24-tuxcare.10 is not affected by CVE-2013-6430. The vulnerability was fixed in upstream Spring Framework 3.2.2 (February 2013) by commit f5c9fe69a4, which added proper escaping for angle brackets (<, >) and Unicode line/paragraph separators (\\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The fix was already present in the upstream Spring Framework 5.3.24 ...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:8fc4e7dc-49a2-5c9a-95bd-888c6c088117", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2015-3192. The vulnerability involves unbounded memory consumption through malicious XML with inline DTD declarations. The upstream fix (commit d79ec68db4 by rstoyanchev@pivotal.io) shipped in Spring Framework 5.3.24, disabling DTD processing by default across all XML parsers (Jaxb2Marshaller, AbstractMarshaller, StaxUtils). The vulnerable pattern\u2014...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:6ccd629b-85f8-5a8e-88d0-4aa185f3899e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.10 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:8f185bf1-f129-51bf-9a4a-d60646202b6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2018-11039. The vulnerability allowed HiddenHttpMethodFilter to accept arbitrary HTTP methods (including TRACE) via the _method parameter, enabling XSS-to-XST escalation. The upstream fix (commit f64fa3dea10 by Brian Clozel, May 2018) restricting allowed methods to PUT/DELETE/PATCH only was already present in the upstream Spring Framework 5.3.24 re...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:39fa66b0-409a-5f86-ba80-fb68e5132071", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. CVE-2021-22118 is not present in Spring Framework 5.3.24. The vulnerability involved predictable temporary directory names in multipart file upload handling, allowing local authenticated attackers to read or modify uploaded files. The upstream fix (introduced in Spring Framework 5.3.7) replaced predictable directory paths with randomly-generated temporary directories using Files.createTempDirectory(). Since the target version is 5.3.24, this fix was already present in the upstream release before TuxCare began maintaining this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:dda54551-5997-56e7-bea1-1985fd165eea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:392c0eb5-36ac-5a47-b3e8-966b576f8ca7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:2bce1823-fd8f-5728-b27f-f9fe2012eb22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:1fd4ca98-144b-551b-bd33-e443392905e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:8c49ddc1-4757-592a-a75a-e6dc04d849b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:67853ac9-6e32-55cc-892c-7a86dbddbd33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it never generates the RFC 2047 quoted filename containing the vulnerable encoding. For non-ASCII charsets, spring-web/src/main/java/org/springframework/http/ContentDisposition.java:256 emits only RFC 5987 filename*. The allowlist at spring-web/src/main/java/org/springframework/http/ContentDisposition.java:497 excludes quotes, semicolons and carriage returns and line feeds, which the encoder at spring-web/src/main/java/org/springframework/http/ContentDisposition.java:553 percent-encodes.", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:211e1edf-1d19-5147-a753-095cfb1ef995", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:82a2ef49-d88b-5026-9daf-cd7fe294ea3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:067c4fdc-7eb1-57ba-908d-b9c0bf256380", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework version 5.3.24 is not affected by CVE-2026-47885. The vulnerable component `PartEventHttpMessageReader` and its `maxPartSize` feature were introduced in Spring Framework 6.0/6.1 and do not exist in the 5.3.x series. Version 5.3.24 uses `DefaultPartHttpMessageReader` for multipart handling, which lacks the `maxPartSize` configuration entirely and therefore cannot exhi...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:ea35aa44-b48d-5530-8c49-bbc97e8e389c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java), which does not exist in version 5.3.24. This version uses Jetty 9.4.49 through the servlet API (JettyHttpHandlerAdapter), not Jetty 12 Core's native reactive API. All reactive server adapters in 5.3.24 (ServletServerHttpResponse, Reac...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:d81a96f7-c6eb-53ef-ae22-c371563b4449", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ], "bom-ref": "urn:uuid:fc633bf6-3a08-5eeb-83f3-11982d3b786f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.24-tuxcare.10" } ] }