{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4a14c183-adff-53a4-bcd2-c35d077b512b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5", "version": "6.1.13-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.13", "type": "library", "group": "org.springframework", "version": "6.1.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:c2313471-c514-5480-adc2-c8b09909dc72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.13 is NOT affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed by upstream Spring team in version 3.2.5 (November 2013) via commit 2ae6a6a341. The target version (6.1.13, released 2024) is over 10 years newer than the fix and contains comprehensive XXE defenses: processExternalEntities defaults to false, XML parser features disable extern...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:4c6f5ebe-03f7-5004-a2be-0759c286c85b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects Spring Framework versions before 3.2.2 due to improper escaping of special characters in JavaScriptUtils.javaScriptEscape(). The target version 6.1.13 already contains the upstream fix (commit f5c9fe69) from February 2013, which adds proper Unicode escaping for line separator (\\u2028), paragraph separator (\\u2029), and angle brackets (<, >). This fix was present in t...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:81f0b9ab-b8ed-5229-8989-e393b6662fd8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.1.13-tuxcare.4 is not affected by CVE-2015-3192. The vulnerability fix was already present in the upstream Spring Framework 6.1.13 release (September 2024) that TuxCare onboarded. The fix, authored by Pivotal/VMware in June 2015, disables DTD processing by default through the `supportDtd` flag (defaults to false) and XML parser feature `http://apache.org/xml/featur...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:591f352e-d5bf-5947-b2f0-c24642805dfc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. Spring Framework 6.1.13-tuxcare.4 is NOT affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) and all RPC-style remoting components that performed unsafe Java deserialization were completely removed in upstream Spring Framework 6.0.0 (commit 5822f1bf85, September 2021). This removal was already present in the upstream 6.1.13 release that TuxCare onboarded. Exhaustive searches confirm zero HTTP Invoker code exists in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:99b34077-d4c7-59eb-8631-41ea0aeaf63c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 affects HiddenHttpMethodFilter by allowing arbitrary HTTP methods including TRACE, enabling XST attacks when combined with XSS. The vulnerability was fixed by restricting allowed methods to PUT, DELETE, and PATCH only. Spring Framework 6.1.13 ships with this fix already present in both servlet and reactive HiddenHttpMethodFilter variants. The fix was authored by upstream Spring d...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:401027e5-2211-523e-9e62-904369a9368a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework 5.2.x < 5.2.15 and 5.3.x < 5.3.7 due to predictable temporary directory paths allowing privilege escalation. The target version 6.1.13 already contains the upstream fix (introduced in 5.3.7) that uses randomly-generated temporary directories via Files.createTempDirectory(). The fix commit 0d0d75e25322d8161002d861fff3ec04ba8be5ac by upstream author apoutsma@pivotal.io was already present in the Spring Framework 6.1.13 release when TuxCare onboarded it. The vulnerable code pattern (static predictable temp directory paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:a33f30db-024d-5e8d-bbcc-e373eef8e50a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. CVE-2024-22243 does not affect Spring Framework 6.1.13-tuxcare.4. The vulnerability involved a URL parsing flaw where the USERINFO_PATTERN regex incorrectly excluded the '[' character, causing UriComponentsBuilder to misidentify the host component in specially crafted URLs (e.g., http://trusted.com[.evil.com@evil.com/). This allowed attackers to bypass host validation checks for open redirect or SSRF attacks. The upstream vendor (Spring) fixed this in commit 120ea0a51c (Feb 9, 2024) by changing USERINFO_PATTERN from ([^@\\\\[/?#]*) to ([^@/?#]*), and further refined it in commit 494ed4e852 (Apr 11, 2024) to ([^/?#\\\\\\\\]*) for better RFC 3986 conformance. Both fixes were included in the upstream Spring Framework v6.1.13 release (Sept 12, 2024) that TuxCare onboarded. The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:7cdb4e19-51d8-5ac2-b67d-697cf5ecb738", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. CVE-2024-22259 is not present in Spring Framework 6.1.13-tuxcare.4. The vulnerability involved permissive regex patterns in UriComponentsBuilder that allowed '@' in userinfo and '[' in host portions, enabling open redirect/SSRF attacks via crafted URLs like 'http://evil.com@trusted.com'. The upstream fix (commit 381f790329, March 5, 2024) removed these characters from the exclusion sets and added IPv6 validation. This fix was already present in the upstream Spring Framework 6.1.13 release before TuxCare onboarded it. The target code contains the corrected patterns at lines 79-81 and the checkSchemeAndHost() validation method at lines 307-322.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:6624c545-7730-53fc-815b-9768ed272c6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. Spring Framework 6.1.13-tuxcare.4 is NOT vulnerable to CVE-2024-22262. The vulnerability (backslash characters not excluded from URL component parsing, allowing host validation bypass for open redirect/SSRF) was fixed in upstream commit 494ed4e852e by Brian Clozel (Broadcom) on 2024-04-11. This fix was already present in the Spring Framework 6.1.13 release that TuxCare onboarded. All four vulnerable regex patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) now correctly exclude backslash characters, preventing attackers from crafting URLs that bypass host validation checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:732b0989-b7ae-58fe-ac73-9d3fbb9e993a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.13 is not affected by CVE-2024-38809. The vulnerable regex-based ETag parsing was already replaced with an efficient state-machine parser in upstream Spring Framework 6.1.12, before this version was released. The fix (commit bb17ad8314) by upstream vendor Broadcom/VMware was included in the 6.1.13 release that TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:4ff2f4a9-b5d9-51af-b3b9-17e4a56efc33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:a470da3b-31d0-5ffa-b68a-523aba657178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:0258d3b9-9914-51bc-b9a1-f91d38920c69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:c0cdbacf-f752-5ac3-8736-a7a71f6132d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:92619c18-6ff6-5f54-96e8-de0818637bd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:fd676f76-5c42-536d-98a9-b417d51f9d5a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.13-tuxcare.5 of org.springframework:spring-web. not_affected \u2014 The target version 6.1.13 is NOT AFFECTED by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0 (January 2024). Version 6.1.13 predates this feature and uses a servlet-based Jetty adapter (JettyHttpHandlerAdapter) that properly handles the sameSite cookie attribute via ServletServ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:16c1b1ad-b9c9-50bf-a13b-1d1f02f9c18d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ], "bom-ref": "urn:uuid:58f103dc-00a9-58f0-92c6-432e8bd3160e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.13-tuxcare.5 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.13-tuxcare.5" } ] }