{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8cc7ab1f-756c-54fe-a830-95269b38339e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8", "version": "6.0.12-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:21ba0f13-b91a-5197-9397-49ef11cc3a2b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 (XXE in SourceHttpMessageConverter) is NOT present in Spring Framework 6.0.12. The vulnerability was fixed by upstream Spring in versions 3.2.5 and 4.0.0.RC2 (Nov 2013). Version 6.0.12 (released 2023) includes these protections: processExternalEntities defaults to false (line 89), external entity features are disabled in all XML parsers (DocumentBuilderFactory line 173, SAXParserF...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:7967a8ab-3983-5a72-a00c-560e2f75a70b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects Spring Framework before version 3.2.2 due to missing character escaping in JavaScriptUtils.javaScriptEscape() for Unicode line separator (U+2028), paragraph separator (U+2029), and angle brackets (<, >). The target repository is Spring Framework version 6.0.12, which already contains the upstream vendor fix from February 2013 (commit f5c9fe69a4). All four vulnerable charac...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:75d0e6ea-49a0-586a-b845-d87fb7340419", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.0.12-tuxcare.6 is NOT AFFECTED by CVE-2015-3192. The vulnerability (improper processing of inline DTD declarations leading to memory exhaustion via entity expansion) was fixed in the upstream Spring Framework release that TuxCare onboarded. Commit d79ec68db40c (authored by rstoyanchev@pivotal.io) added the defense (supportDtd=false by default, disallow-doctype-decl...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:e5077a12-3201-52f9-97f1-50751af83549", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. Spring Framework 6.0.12-tuxcare.6 is NOT affected by CVE-2016-1000027. The vulnerable HttpInvoker classes (HttpInvokerProxyFactoryBean, HttpInvokerServiceExporter, etc.) that performed unsafe Java deserialization over HTTP were completely removed by the upstream Spring Framework vendor in version 6.0.0 (commit 5822f1bf85, September 2021). Since the target version 6.0.12 is later than 6.0.0, these classes never existed in this version. The CVE explicitly states it affects Spring Framework \"before 6.0.0\" and version 6.0.0 \"removed it entirely.\" Exhaustive searches confirm the entire org.springframework.remoting.httpinvoker package is absent from the target repository. The removal was authored by Juergen Hoeller (upstream Spring maintainer) and was already present in the upstream 6.0.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:d8a294ab-2acd-5408-b889-e75086bd3d37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.0.12-tuxcare.7 is NOT AFFECTED by CVE-2018-11039. The vulnerability (unrestricted HTTP method override via HiddenHttpMethodFilter allowing escalation from XSS to XST attacks via TRACE) has been fixed in the upstream release. Both servlet and reactive variants contain the ALLOWED_METHODS allowlist (PUT, DELETE, PATCH only) that blocks dangerous methods like TRACE. T...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:2ff617a4-ec32-5526-b7ab-6922f72420cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework versions with predictable temporary directory paths for multipart file uploads. The target (Spring Framework 6.0.12-tuxcare.7) contains the upstream fix: FileStorage.java uses Files.createTempDirectory() to create random temp directories, preventing directory collision attacks. The fix was authored by apoutsma@pivotal.io and shipped in the upstream 6.0.12 release. The vulnerable code pattern (predictable paths like java.io.tmpdir/spring-multipart) is not present. Additionally, SynchronossPartHttpMessageReader (covered by the first upstream patch) was removed in Spring 6.0 during Jakarta EE migration, further reducing attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:855692bd-b683-54f8-9ed7-6bc52eee9bfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:40d819f4-b51f-505a-aa2d-0a37d1c5b519", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:c99a3c6f-1b27-5962-a315-8afe547ae034", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:43c97c7e-abb6-5409-9ca0-f24964c8aa70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:c4228af3-7ecf-5748-8732-54a69b511a62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:a339f5c7-feea-55b5-9496-5c11f8bd89ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:d7082a51-21e0-5f10-822e-47e93a086e9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:1e4ab03b-555c-5605-aba4-8b86dd849700", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3c6d97bc-3cc4-5a5b-bfb5-d326b96496b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2026-47885. This CVE describes a bug in the enforcement of the maxPartSize limit when maxInMemorySize is set to -1. However, the maxPartSize feature itself does not exist in version 6.0.12\u2014it was introduced in version 6.1.0 (commit 66aac7e359, dated 2023-10-25). The specific vulnerable code pattern (conditional logic that fails to check maxPartSize...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:37788301-ece6-5bde-9568-eb43aedbd7bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2026-47889. The vulnerability exists only in the JettyCoreServerHttpResponse class, which implements support for the Jetty 12 Core reactive adapter. This component was introduced in Spring Framework 6.2.0-M5 (commit 0a60c622cc, July 2024) and does not exist in version 6.0.12. Version 6.0.12 only contains servlet-based Jetty adapters (Jetty11ServerH...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:49e47d55-8097-53f0-8803-9ea17a3fc905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:1948f045-3ffd-5895-ae30-09b5e098562e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.12-tuxcare.8" } ] }