{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9e1f7fa3-1472-53f7-a045-35233b016869", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3", "version": "5.3.32-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e604de4d-fd2d-5d68-b1b5-7ca4cb9983e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2013-6429. The XXE vulnerability fix was already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded. The fix (commit 2ae6a6a341 from Nov 2013) disables external entity processing by default in SourceHttpMessageConverter, and was authored by the upstream Spring team (rstoyanchev@gopivotal.com), not by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:4024a557-0780-52ee-8e6a-ecbb9b11a2be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 5.3.32. The vulnerability affected JavaScriptUtils.javaScriptEscape() which failed to properly escape four special characters (<, >, \\u2028, \\u2029), enabling XSS attacks. The upstream fix (commit f5c9fe69a4, dated 2013-02-15) was included in Spring Framework 5.3.0 and all subsequent 5.3.x releases. The target version 5.3.32 contains the complete...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:ff22259c-01f1-588e-96d2-78ce728bd5e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 concerns DTD processing in Spring Framework XML parsers that could cause denial of service through memory exhaustion. The target (Spring Framework 5.3.32-tuxcare.3 at SHA 332413a647) is not affected because the upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2015-06-30 was already present in the upstream 5.3.32 release that TuxCare onboarded. All affected co...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8a243ea8-40e1-5638-9437-8a94e29b6bad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:81913d6b-bb55-5e28-90e5-c4e3bdddc4b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 5.3.32. The vulnerability allowed unrestricted HTTP method override via the _method parameter in HiddenHttpMethodFilter, enabling attackers to escalate to dangerous methods like TRACE for XST attacks. The upstream fix (commit f64fa3dea10 by Brian Clozel, 2018-05-18) added ALLOWED_METHODS allowlist restricting method override to only PUT, DELETE,...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5b730c5a-ca35-5788-92af-380d5ad98a88", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. Spring Framework 5.3.32 is not affected by CVE-2021-22118. The vulnerability was fixed in upstream version 5.3.7, and the target version 5.3.32 includes those fixes. Both DefaultPartHttpMessageReader and SynchronossPartHttpMessageReader use Files.createTempDirectory() with random suffixes, preventing privilege escalation attacks via predictable temporary directory paths. The fixes (commits cce60c479c22 and 0d0d75e253) were authored by upstream Spring Framework developers and were already present in the 5.3.32 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:2e4d2d05-58e2-5417-9076-0bb0bbd7cc3e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. CVE-2024-22243 (UriComponentsBuilder parsing ambiguity allowing host validation bypass) is not present in Spring Framework 5.3.32 at HEAD (332413a647). The upstream vendor (Spring) already fixed this vulnerability before TuxCare onboarded version 5.3.32. The current code contains the fixed USERINFO_PATTERN that allows bracket characters, eliminating the parsing ambiguity that enabled open redirect/SSRF attacks. Fix commit 7ec5c994c1 by rossen.stoyanchev@broadcom.com was included in the upstream 5.3.32 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e1f1d8ff-641d-5967-b91b-b10863d84242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:fab30aef-1bd8-5d70-a259-706f3b1a450c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a26f12d6-50e1-5bd6-8b17-7865c5def5e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:fb4eac50-165f-5713-b6b9-ba0374fd54d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.32-tuxcare.4." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3cfc161c-c408-5c5c-9f78-14a6ed0fef95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2025-41234. The vulnerability exists in version 6.x where both filename= (quoted-printable) and filename*= (RFC 5987) parameters are output when using non-ASCII charset. Before the fix, the filename= parameter's quoted-printable encoding allowed literal double-quotes, enabling header manipulation. Version 5.3.32 uses a fundamentally different archi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e07d0c8a-ba89-524a-a31c-307baa8eaa14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a9c2c6b3-242d-50ac-b343-621d816d7922", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.32-tuxcare.5." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:37dae09a-b43f-5776-943e-1a6c95ad09e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2026-47885 does not affect Spring Framework 5.3.32-tuxcare.3. The vulnerability is specific to PartEventHttpMessageReader, a class introduced in Spring Framework 6.0.0-M4 (February 2022) that does not exist in version 5.3.32. The CVE describes a bug where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.32 uses different multipart readers (DefaultPartHt...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:b32a8de9-7f7b-5b66-9268-e6a141c22e77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which does not exist in version 5.3.x. This version uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes the sameSite cookie attribute via ResponseCookie.toString(). The vulnerable code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:67acc1e4-a918-5cb6-a476-1f42d860a740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5ebefee7-0fce-54cc-bbb5-7c5e4f83151a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ] }