{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9cfbcc18-e83a-5493-9202-e6a3a460bb17", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4276d7f5-2847-5cf0-bb1f-c1e90a98e498", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Target version 6.1.16 is not affected by CVE-2013-6429 (XXE vulnerability in SourceHttpMessageConverter). The upstream fix that disables external entity processing by default was introduced in Spring Framework v4.0.0.RC2 (November 2013) by upstream maintainer Rossen Stoyanchev and is present in the target code. The vulnerable pattern no longer exists because external entities are disabled by de...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1b367051-ef2e-51b5-b30d-ee70e66f7917", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is NOT present in Spring Framework 6.1.16-tuxcare.7. The vulnerability affected JavaScriptUtils.javaScriptEscape which failed to escape angle brackets (<, >) and Unicode line/paragraph separators (\\u2028, \\u2029), enabling XSS attacks. The upstream vendor fix (commit f5c9fe69a4, 2013-02-15, by rstoyanchev@vmware.com) added all four required character escapes. This fix was already ...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:5b34186c-3671-58a8-aef5-1204f49c8ba5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper DTD processing allowing XML bomb attacks. The target version 6.1.16-tuxcare.7 is NOT affected because the upstream fix (commit d79ec68db4 by Rossen Stoyanchev) was already present in the Spring Framework release that TuxCare onboarded. The fix disables DTD processing by default across all XML proc...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:29fc2762-2f10-51de-a3bc-05086edf0252", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. CVE-2016-1000027 affects Spring Framework's HTTP invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) which allowed unsafe Java deserialization of untrusted data, leading to potential RCE. These classes were completely removed from Spring Framework in version 6.0.0 (commit 5822f1bf85, Sep 2021) by upstream author Juergen Hoeller. The target version 6.1.16-tuxcare.7 does not contain any of the vulnerable classes - they were already removed in the upstream release that TuxCare onboarded. The fix was an upstream removal, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:66ebb2c5-d0cd-5d27-a9c1-c9d53abd3c77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Target Spring Framework 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2018-11039. Both HiddenHttpMethodFilter implementations (Servlet and Reactive) contain the ALLOWED_METHODS allowlist defense that restricts method overrides to PUT, DELETE, and PATCH only, preventing unrestricted HTTP method override attacks including XST escalation. The fix was introduced by upstream Spring Framework commits in Ma...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:49c5ad72-4c62-5e67-b389-f61b83ae5159", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework versions 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. The vulnerability involved predictable temporary directory paths for multipart file uploads, allowing local attackers to manipulate uploaded files. The target version 6.1.16 contains the upstream fix (commit 0d0d75e25322d8161002d861fff3ec04ba8be5ac) which was introduced in Spring Framework 5.3.7. The fix replaces predictable directories with randomly-generated paths via Files.createTempDirectory(). This fix shipped in the upstream release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:78eab73f-9cfa-5947-a0d8-894df33f3c0d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. CVE-2024-22243 is NOT present in Spring Framework 6.1.16. The vulnerability involved UriComponentsBuilder incorrectly parsing URLs like `http://trusted.com[@evil.com` - the vulnerable regex pattern excluded `[` from userinfo, causing the parser to misidentify \"trusted.com\" as the host when the actual destination is \"evil.com\". This enabled open redirect/SSRF attacks bypassing host validation. The upstream fix (commit 120ea0a51c by rossen.stoyanchev@broadcom.com on 2024-02-09) removed `[` from the exclusion list, correctly parsing such URLs. This fix shipped in the upstream Spring Framework 6.1.16 release before TuxCare onboarded it (first TuxCare commit 73712e8616 on 2026-08-09). A subsequent upstream refinement (494ed4e852e on 2024-04-11) further improved RFC 3986 compliance while preserving the CVE fix. The current target code at line 80 has USERINFO_PATTERN = \"([^/?#\\\\\\\\]*)\" which does NOT exclude `[`, confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1405d9a7-5e48-5266-be7c-ee1140fb4678", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. CVE-2024-22259 affects UriComponentsBuilder URL parsing that could allow open redirect/SSRF attacks. The upstream Spring Framework fix (commit 381f790329, March 5, 2024) was already present in the upstream release 6.1.16 before TuxCare onboarded it. The fix modifies regex patterns (USERINFO_PATTERN, HOST_IPV4_PATTERN) and adds checkSchemeAndHost() validation to prevent malformed URLs from bypassing host validation. Target version 6.1.16 contains this fix plus additional refinements (commit 494ed4e852). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:737d73ab-2c78-5bc2-a308-2909b4d51c59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. The target Spring Framework 6.1.16 is NOT affected by CVE-2024-22262. The vulnerability pattern (missing backslash exclusion in URI parsing regex patterns) was fixed by the upstream Spring Framework team in version 6.1.6 (commit 494ed4e852, April 2024, author Brian Clozel). This fix was already present in the upstream 6.1.16 release that TuxCare onboarded. The vulnerable patterns are not present in the target code - all four regex patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) correctly exclude backslash characters per RFC 3986.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:066acde1-3204-5c3b-a55e-6c0daca81cb0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 does not affect Spring Framework 6.1.16-tuxcare.7. The vulnerability (ReDoS in ETag header parsing via catastrophic regex backtracking) was fixed by upstream Spring Framework in version 6.1.12 (commit bb17ad8314 by rossen.stoyanchev@broadcom.com on 2024-08-14). The fix replaced the vulnerable regex pattern with an efficient O(n) state-machine parser in a new ETag.java class. TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:5c8eb267-91d8-591e-b5be-aaf52667921f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38820 is not present in Spring Framework 6.1.16. The upstream release already shipped with the fix (commit 23656aebc6, using Locale.ROOT for case conversion). A subsequent TuxCare backport (CVE-2025-22233) replaced this with simpleMatchIgnoreCase(), which is also locale-independent. The vulnerable pattern (toLowerCase() without Locale.ROOT) does not exist in the current code.", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:28da7a48-b85c-5214-918f-5b8e0d64354d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:0b1767d5-7c1b-514b-9109-14eb05a71e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:166ae4a6-44eb-5f30-bde5-c5976a2b4c45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:0a287cbf-e775-5f59-8705-7b5c05147892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:28540ffa-5c3c-504c-a706-6a972dc62bd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2026-47889. The vulnerability exists only in the JettyCoreServerHttpResponse class, which is part of the Jetty 12 Core (non-servlet) reactive adapter. This adapter was introduced in Spring Framework 6.2.x and does not exist in the 6.1.x branch. The target version 6.1.16 only has the servlet-based Jetty adapter (Jetty12ServerHttpResponse extending S...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:624993f8-3633-5e30-b522-135569b1fd75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4e8898eb-916f-538d-b697-adc21df96cc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.6" } ] }