{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:437958af-8959-567b-b4b3-7d4a71bf25c3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8aabf1e8-c815-52ae-8979-77a52a40db53", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 concerns XXE vulnerability in SourceHttpMessageConverter where external entity resolution was not disabled. The target repository at version 6.0.23-tuxcare.12 is NOT vulnerable because the upstream fix (commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a by Rossen Stoyanchev from Pivotal, dated 2013-11-05) was already present in the upstream Spring Framework release before TuxCare onb...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:adcc2f12-07f6-564b-bcdb-81242bc16d71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is NOT present in spring-framework 6.0.23-tuxcare.12. The vulnerable pattern (unescaped angle brackets and Unicode line/paragraph separators in JavaScriptUtils.javaScriptEscape) does not exist because the fix was already included in the upstream release. The fix commit (f5c9fe69a4 by rstoyanchev@vmware.com) shipped in upstream Spring Framework before TuxCare onboarded version 6.0....", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8d8c55b7-c633-53ad-89f5-cb471eb1931b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2015-3192. The upstream fix disabling DTD processing by default was committed in June 2015 (d79ec68db4 by rstoyanchev@pivotal.io) and was already present in the official v6.0.23 release that TuxCare onboarded. All XML parsing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jackson2ObjectMapperBuilder) have `supportDtd=f...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:aa1d8e6b-93dc-5f12-adba-c7a24c9aa57e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. Spring Framework 6.0.23 is not affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) that enabled unsafe Java deserialization were completely removed in upstream Spring Framework 6.0.0 via commit 5822f1bf85 (2021-09-17) by Juergen Hoeller. This removal was part of the upstream release that TuxCare onboarded, and no alternative HTTP remoting with Java deserialization exists in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0653798e-cf92-56a0-8a64-3c66222c8302", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2018-11039. The vulnerability allowed HiddenHttpMethodFilter to accept any HTTP method (including TRACE) via the _method parameter, enabling XST attacks when combined with XSS. The upstream fix restricting allowed methods to PUT, DELETE, and PATCH was shipped in Spring Framework 5.0.7/4.3.18 (May 2018). Version 6.0.23 inherited this fix from its up...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e0e12b8e-ad81-5d69-8460-ce5920c62bb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. Spring Framework 6.0.23 is not affected by CVE-2021-22118. The vulnerability involved predictable temporary directory paths for multipart file uploads that could be manipulated by attackers. The upstream fix (commit 0d0d75e253) was already present in the Spring Framework 6.0.x release that TuxCare onboarded. The vulnerable code pattern has been completely replaced with secure random temporary directory creation using Files.createTempDirectory(). The SynchronossPartHttpMessageReader class (subject of the second patch) does not exist in Spring Framework 6.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:97d5c538-64db-52e7-9510-32eff7b0e6e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. The target Spring Framework 6.0.23 is not affected by CVE-2024-22243. The vulnerability fix (removing left square bracket from USERINFO_PATTERN exclusions to prevent URL parsing confusion) was already present in the upstream v6.0.23 release before TuxCare onboarded it. The vulnerable pattern that caused host misidentification when `[` appeared in URLs is not present in the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ddc0a368-b2ef-57c7-8d59-520a63b8fd1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. CVE-2024-22259 affects Spring Framework's UriComponentsBuilder when parsing externally-provided URLs with malformed host components. The vulnerability allows open redirect or SSRF attacks by crafting URLs with special characters (@, [) that bypass host validation. The target repository (Spring Framework 6.0.23-tuxcare.12) is NOT AFFECTED because the fix was already present in the upstream Spring Framework 6.0.23 release, which TuxCare onboarded. The vulnerable regex patterns (with @ and \\[ exclusions) are not present in this version; the fixed patterns and checkSchemeAndHost validation method shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:19cd4b3a-263f-5a12-9538-bbfdb4308d50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. CVE-2024-22262 affects Spring Framework's UriComponentsBuilder when parsing externally-provided URLs containing backslash characters in scheme/userinfo/host/port components, potentially allowing open redirect or SSRF attacks by bypassing host validation. The upstream fix (commit 402246df28) adds backslash exclusion to four regex patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) to prevent parsing of malformed URLs. This fix was already present in the upstream Spring Framework 6.0.23 release before TuxCare onboarded this version (first TuxCare commit: 73315ed209). The fix was authored by brian.clozel@broadcom.com (upstream vendor). Target version 6.0.23-tuxcare.12 contains the complete fix; vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:083d3658-6b7a-566c-9d13-734f2895f5c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 affects Spring Framework 6.0.0-6.0.22 with a ReDoS vulnerability in ETag header parsing. The target version 6.0.23 is the upstream FIXED version. The fix (commit 8d16a50907c1 by rossen.stoyanchev@broadcom.com) was shipped in the upstream 6.0.23 release that TuxCare onboarded, NOT added by TuxCare backport. The vulnerable regex pattern (ETAG_HEADER_VALUE_PATTERN) has been replaced...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1da73d7d-7cef-515d-b317-1c6ca7644f69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0f7ddbe9-5f27-5848-8b5b-3549356fabad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:21c3dc55-47cb-537e-9e1c-da76754f9610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1555cd15-bf26-5780-8b74-1570543b5661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:abc3691b-8f0e-5e6b-b692-c8501f3fefe2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2026-47885. The vulnerability describes a bug in the maxPartSize feature where maxPartSize limits are not enforced when maxInMemorySize is set to -1. However, Spring 6.0.23 does not have the maxPartSize feature at all - it was introduced later in the 6.1.x release line (commit 66aac7e359, Oct 2023). Since the vulnerable feature is not present in 6....", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:804b387a-2ba6-5bd2-9e02-6188d7ca46f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Version 6.0.23 is NOT affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0. Version 6.0.23 predates this feature and only contains servlet-based Jetty adapters (Jetty11ServerHttpResponse and Jetty12ServerHttpResponse), which correctly serialize the sameSite cookie attrib...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:11001aa8-762b-5c09-a345-32c54c839b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fe11c8a5-8744-514f-b79f-0b656dfc070a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ] }