{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e2f9f830-a2c4-5bd1-9e04-5946d6761a81", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3", "version": "6.1.14-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.14", "type": "library", "group": "org.springframework", "version": "6.1.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:6506d55e-81a6-5905-91c5-625e089d27f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2013-6429 (XXE in SourceHttpMessageConverter). The vulnerability pattern is absent because the upstream fix that disables external entity resolution by default was already present in the Spring Framework 6.1.14 release before TuxCare onboarded it. The fix (commit 2ae6a6a341 by upstream developer rstoyanchev@gopivotal.com) sets processExternalEntiti...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:35963d2a-d6dc-5d8a-bd03-6e6f1425c646", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework version 6.1.14 is not affected by CVE-2013-6430. The vulnerability requires the absence of proper escaping for Unicode line separators (U+2028, U+2029) and angle brackets (<, >) in the JavaScriptUtils.javaScriptEscape method. The target's JavaScriptUtils.java (lines 79-92) contains the complete fix that escapes all four vulnerable characters using JavaScript-safe Uni...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b2b01967-2d28-54fe-8854-6fbb0ea5582e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.14-tuxcare.3 is NOT affected by CVE-2015-3192. The vulnerability affects Spring Framework before 3.2.14 and 4.x before 4.1.7. The upstream fix (commit d79ec68db4 by rstoyanchev@pivotal.io) was already present in the Spring Framework 6.1.14 release before TuxCare onboarding. The fix disables DTD processing by default via the 'supportDtd' field (defaults to false) and the 'di...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:1cfa9eb0-6f3f-5150-ae1c-f5eafdff0a7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. CVE-2016-1000027 affects Spring Framework's HTTP Invoker classes which enabled Java deserialization of untrusted data over HTTP. The target version 6.1.14 is NOT affected because all HTTP Invoker and RPC-style remoting classes were completely removed by the upstream Spring Framework project in version 6.0.0 (commit 5822f1bf85, September 2021). The vulnerable classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter, etc.) do not exist in the target codebase. This removal was already present in the upstream 6.1.14 release that TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:772b2002-0ccf-5a39-b99f-f057796c4125", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2018-11039. Both HiddenHttpMethodFilter variants (servlet and reactive) contain the upstream fix that restricts HTTP method overrides to an allowlist of PUT, DELETE, and PATCH only. The vulnerability pattern (unrestricted method override allowing TRACE) is not present because the upstream vendor (Spring Framework) applied the fix in version 5.0.7 (...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:408d5e24-c578-56e1-b85d-4e454403eb53", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework versions 5.2.x < 5.2.15 and 5.3.x < 5.3.7. The target version 6.1.14-tuxcare.3 is significantly newer and already contains the upstream fix. The vulnerability involved predictable temporary directory paths (/tmp/spring-multipart) that allowed local attackers to manipulate file storage. The fix (commits cce60c479c and 0d0d75e253) replaced predictable paths with randomly-generated temporary directories using Files.createTempDirectory(). These fixes were authored by upstream maintainer Arjen Poutsma (apoutsma@pivotal.io) and shipped in the upstream release 6.1.14, which TuxCare subsequently onboarded. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b1a35fc6-6e97-52e9-b599-425bdc1995c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. Spring Framework v6.1.14-tuxcare.3 is not affected by CVE-2024-22243. The vulnerable USERINFO_PATTERN regex that allowed parsing ambiguity with the '[' character was fixed in upstream commit 120ea0a51c63171e624ca55dbd7cae627d53a042 (Feb 9, 2024) by rossen.stoyanchev@broadcom.com. This fix shipped in upstream Spring Framework v6.1.4 (Feb 23, 2024), well before TuxCare onboarded v6.1.14. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:3562c830-3fff-5fbf-8402-ad5e1c0665cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. CVE-2024-22259 affects Spring Framework applications that use UriComponentsBuilder to parse externally provided URLs and perform host validation. The vulnerability allows host validation bypass through malformed IPv6 bracket notation, enabling open redirect or SSRF attacks. The target Spring Framework 6.1.14-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream Spring Framework 6.1.14 release (October 2024) that TuxCare onboarded. The fix commit (381f790329, March 2024) introduced the checkSchemeAndHost validation method that rejects hosts starting with '[' but not ending with ']', preventing malformed bracket notation from bypassing validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:e6e11454-bc26-5bce-bb0a-059194f91682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. CVE-2024-22262 affects Spring Framework's UriComponentsBuilder URL parsing, which could allow open redirect or SSRF attacks when applications parse externally provided URLs with backslash characters in the authority section and perform validation on the parsed host. The vulnerability arises from regex patterns that did not reject backslash characters, allowing misinterpretation of the host component. The target repository (Spring Framework 6.1.14) is NOT AFFECTED because the upstream fix (commit 494ed4e852) was already included in the Spring Framework 6.1.14 release when TuxCare onboarded it. The fix adds backslash to negated character classes in SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, and PORT_PATTERN, preventing URLs with backslashes from being parsed in a way that bypasses host validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:48e05a5a-5e82-5cb7-9e08-fba65e21f2cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 is NOT present in spring-framework 6.1.14-tuxcare.3. The vulnerability was a regex-based ETag parser (ETAG_HEADER_VALUE_PATTERN) in HttpHeaders.java and ServletWebRequest.java that exhibited catastrophic backtracking, causing DoS when processing malicious If-Match/If-None-Match headers. The upstream Spring Framework fixed this in version 6.1.12 by introducing ETag.java with a lin...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:7f94f2d4-6ef3-5253-9d0a-629182bdf0ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. The upstream fix was released in 6.1.14, and version 6.1.14 is a later release of the same line. Advisories: GitHub GHSA-4gc7-5j7h-4qph (fixed in 6.1.14), NVD (fixed in 6.1.14), CVE record (fixed in 6.1.14), Snyk (fixed in 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b9c11ad0-ecc0-5773-9324-675018c6a8e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:259b9aae-673a-5e30-afa0-b902dd614dc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:8a0ddc9c-ebb3-5d6b-812c-dc8387c79ca1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:339f6f5a-e702-5920-b4be-24aa0d282276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:11dae801-dc6e-5f11-8890-5db56985af7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2026-47889. The vulnerability exists in the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse), which was introduced in Spring Framework 6.2.0 (January 2024). Version 6.1.14 predates this feature and only supports Servlet-based Jetty integration via ServletServerHttpResponse, which correctly handles sameSite cookie attributes by setting c...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:d0356367-a4e6-53cc-8477-13a638dbcf2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:241f2278-a720-5a0b-b3b1-7afb7c1af8a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.14-tuxcare.3" } ] }