{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:52b9c224-ba7a-5dfc-ab9a-947a18aa83c0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7", "version": "6.0.13-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.13", "type": "library", "group": "org.springframework", "version": "6.0.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:99f608da-2c50-53df-bab3-a90318868f79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 XXE vulnerability is not present in Spring Framework 6.0.13. The fix was already included in the upstream release before TuxCare onboarded this version. The SourceHttpMessageConverter class correctly disables external entity processing by default (processExternalEntities=false) and implements NO_OP entity resolvers for all XML source types (DOM, SAX, StAX). This defense prevents a...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:510f89aa-9f31-5966-a894-4a54752791a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 6.0.13. The vulnerability required escaping four specific Unicode characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape() to prevent XSS attacks. The target repository contains the complete upstream fix at lines 79-92 of JavaScriptUtils.java, which was included in the upstream v6.0.13 release (2023-10-12) before TuxCare onboarded ...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:cfc1f329-1036-5095-a231-2eaac1f4d380", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.13 is NOT affected by CVE-2015-3192. The vulnerability involved improper DTD processing that could cause denial of service through memory exhaustion. The upstream Spring Framework team (Rossen Stoyanchev @ Pivotal) fixed this vulnerability by adding DTD disabling controls across all XML parsers (SAX, DOM, StAX). The fix was already present in Spring Framework 6.0.13 when Tu...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:6d1cdf1b-6a47-5fc8-900d-741a3323e1f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. The target Spring Framework 6.0.13 is not affected by CVE-2016-1000027. The vulnerable Java deserialization classes (HttpInvokerServiceExporter, SimpleHttpInvokerServiceExporter, RemoteInvocationSerializingExporter, and the entire RPC-style remoting infrastructure) were completely removed from Spring Framework in version 6.0.0 by upstream commit 5822f1bf85 (author: hoellerj@vmware.com, date: 2021-09-17). This removal was part of the upstream Spring Framework 6.0.0 release and was already present when TuxCare onboarded version 6.0.13. The vulnerable code patterns no longer exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:e4e9971c-e846-51fb-8d1f-55fcd4b85313", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.13 is NOT affected by CVE-2018-11039. The vulnerability (allowing arbitrary HTTP method override including TRACE via HiddenHttpMethodFilter, enabling XST attacks) was fixed in upstream Spring Framework in May 2018. Both HiddenHttpMethodFilter variants (Servlet and Reactive) in the target contain the fix: an ALLOWED_METHODS whitelist restricting method overrides to PUT, DELE...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:7f9411a5-b486-5671-824e-ffe563e38d1d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. The target Spring Framework 6.0.13 is not affected by CVE-2021-22118. The vulnerability concerned predictable temporary directory paths in multipart file upload handling (affecting versions 5.2.x < 5.2.15 and 5.3.x < 5.3.7). The fixes were committed by upstream Spring developer Arjen Poutsma on 2021-05-11 and first appeared in versions 5.2.15 and 5.3.7. These fixes were already present in the upstream Spring Framework 6.0.13 release that TuxCare onboarded. The target uses FileStorage.java which creates random temporary directories via Files.createTempDirectory(\"spring-multipart-\"), preventing directory pre-creation attacks. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:2ae4d171-788c-58ed-9f98-ff0770147169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:577479a7-6441-50c4-81cc-76110a5fd3ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.13-tuxcare.7 of org.springframework:spring-web, and is fixed in 6.0.13-tuxcare.8." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:915bbb07-9507-57af-91d7-3c2a6fc3b09a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:725f224f-cd54-5696-8ab9-94a619c1c9e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:19f5470b-affd-53bd-8110-99bc05d95f59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.13-tuxcare.7 of org.springframework:spring-web, and is fixed in 6.0.13-tuxcare.8." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:8ee2623c-cf2d-564c-8daf-2f882fb4cb12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:d34d1026-fb16-58b4-b2d7-5c28558ca7eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:8a2c6f9f-9a76-5a10-bf33-3839b771a9b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:6c6ee1ef-20ae-5164-992f-2e499737e7b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 Target version 6.0.13-tuxcare.6 is not affected by CVE-2026-47885. The vulnerability requires the `maxPartSize` configuration feature, which was introduced in Spring Framework v6.1.0-RC2 (October 2023) via commit 66aac7e359. Version 6.0.13 predates this feature and contains only `maxInMemorySize` for size control. The CVE describes a bug where maxPartSize is not enforced when maxInMemorySize is...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:1ad7cec5-9f00-55e2-a34b-bc516102d1c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.13 is not affected by CVE-2026-47889. The vulnerability exists in the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java), which was introduced in Spring Framework 6.2.1. Version 6.0.13 only includes servlet-based Jetty adapters (for Jetty 11 and Jetty 12 EE10) that properly serialize response cookies with their sameSite attributes via ResponseCookie.toString(...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:2230bb14-9d35-5c1b-a351-1491e5757b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ], "bom-ref": "urn:uuid:cd37e3b4-32f4-5e28-9208-dce8bd92747f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.13-tuxcare.7" } ] }